Gmail: Google clarifies reports of leaked passwords

Google has denied reports suggesting that millions of Gmail accounts were compromised, describing the claims as inaccurate and based on a misunderstanding of ongoing cyber activity across the web.

Recent reports by some international media outlets, including Daily Mail and Forbes, had reported that a “Gmail password leak” allegedly affected millions of users.

However, Google has clarified that there was no breach of its Gmail systems, insisting that the reports stem from a misinterpretation of standard, ongoing “infostealer” activity.

In a statement sent to PM News, a Google spokesperson said:

“Reports of a Gmail security ‘breach’ impacting millions of users are entirely inaccurate. They stem from a misreading of ongoing updates to credential theft databases, known as infostealer activity, whereby attackers employ various tools to harvest credentials rather than a single, specific attack aimed at any one person, tool, or platform.”

The company explained that these incidents involve cybercriminals using infostealer malware to collect login information from compromised devices and accounts across the internet, not from Gmail’s internal servers.

Google emphasized that it has multiple security measures in place to protect users and urged account holders to follow best practices for account protection, including enabling two-step verification, adopting passkeys as a safer alternative to passwords, and resetting passwords whenever they appear in large data dumps.

The tech giant added that it has an established process for automatically resetting compromised passwords when large-scale credential leaks are detected.

Google reiterated that its systems remain secure and that the company continues to monitor and act against credential theft across the web.

“We encourage users to remain vigilant and take simple precautions to secure their accounts,” the spokesperson added.

For more information, Google directed users to its online safety resources on setting up passkeys and recovering hacked accounts.