Loading story…
Google publicly denied reports of a massive Gmail security breach after several media outlets claimed that millions or even billions of Gmail accounts had been compromised. The confusion arose when Have I Been Pwned (HIBP) added a dataset of 183 million credentials, many containing Gmail addresses, to its breach notification platform. Google clarified that the dataset was not the result of a new breach, but rather a collection of credentials harvested over years from infostealer malware and other sources, with the majority of the data being old or recycled.
Despite sensational headlines, Google emphasized that its security defenses remain strong and that users are protected. The company explained that infostealer databases often contain Gmail addresses due to widespread reuse across the internet, and that the appearance of such large collections is frequently misinterpreted as evidence of a new compromise. Of the 183 million credentials added to HIBP, only about 16.4 million were new entries, with the rest already present in previous leaks. Google urged users to adopt strong passwords and enable multi-factor authentication to further protect their accounts.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Google publicly rejected the breach claims, stating there was no new compromise of Gmail and that the credentials came from old infostealer logs, phishing campaigns, and other third-party breaches. The company said it already scans for stolen credentials and prompts affected users to reset passwords when needed.
News reports circulated claiming that more than 183 million Gmail accounts had been breached, mischaracterizing an aggregated credential dump as evidence of a new compromise of Gmail systems. The claims amplified confusion about the origin and significance of the exposed credentials.
Troy Hunt added a dataset containing 183 million credentials to Have I Been Pwned after sourcing it from Synthient. He noted the data reflected years of infostealer activity and that about 91% of the credentials were already circulating online, rather than representing a new Gmail-specific breach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcesecurityonline.info
Open sourcetechrepublic.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Have I Been Pwned (HIBP), the widely used data breach notification service, has indexed nearly 2 billion unique email addresses and 1.3 billion passwords from newly obtained datasets, marking the largest single update in the platform's history. The data, sourced in part from threat intelligence provider Synthient, includes both stealer log data—collected by malware from infected machines—and credential stuffing lists, which are typically compiled from previous breaches and used to facilitate unauthorized access to accounts across multiple services. This update brings the total number of accounts tracked by HIBP to over 15 billion, significantly expanding the visibility of exposed credentials for individuals and organizations. The newly indexed records include 183 million unique email addresses uploaded on October 21, as well as a much larger corpus totaling nearly 2 billion addresses and 1.3 billion passwords, 625 million of which were previously unseen. Users are encouraged to check their exposure using HIBP's free search tools and to take immediate action if their credentials are found, such as changing passwords and enabling multi-factor authentication. The scale and diversity of the data highlight the ongoing risks of password reuse and the importance of proactive credential management to mitigate the threat of account takeover attacks.
Jul 12, 2026
Google said it warned more than **14,000 Gmail users** that they were targeted in a late-September spear-phishing campaign attributed to **APT28**—also known as **Fancy Bear**—a state-sponsored group previously linked by the FBI and NSA to Russia’s **GRU** and military unit **26165**. According to Google Threat Analysis Group director Shane Huntley, the operation accounted for **86%** of the company’s warning notifications for that month, and Google said it blocked all emails used in the campaign. The alerts are part of Google’s long-running warning system for suspected state-sponsored attacks, which the company says is based on internal monitoring, detailed analysis, and victim reports. Google emphasized that such notices indicate **suspected targeting rather than confirmed account compromise**, and advised affected users to harden defenses by using unique passwords, enabling **2-step verification**, keeping software updated, and confirming sign-ins occur through `https://accounts.google.com/`.
Aug 15, 2026
Have I Been Pwned (HIBP) has incorporated a new dataset containing 183 million unique stolen email and password pairs, sourced and aggregated by a U.S. college student known as Ben for the cybersecurity company Synthient. The dataset, totaling 23 billion rows and 3.5 terabytes, was compiled from infostealer malware logs, Telegram groups, Tor sites, and various underground forums, reflecting the industrial scale at which credentials are stolen, traded, and reused across the dark web. Security experts note that this aggregation highlights the persistent threat posed by credential theft, password reuse, and the automation of attacks, which collectively undermine digital trust and make traditional defenses less effective. The Synthient dataset is notable for its breadth, as it combines real credentials captured from infostealer malware with credential stuffing lists, rather than being the result of a single breach. This collection process demonstrates how stolen credentials move through a digital supply chain, being shared, merged, and resold repeatedly. The exposure of such a vast number of credentials underscores the importance of maintaining visibility into leaked data, enforcing multi-factor authentication, and adopting stronger authentication practices to mitigate the risks associated with widespread credential compromise.
Jun 29, 2026