Google has refuted claims of a large-scale Gmail security breach following online reports suggesting that millions of user passwords had been leaked. The company clarified that the allegations were rooted in a misunderstanding of older stolen data being recirculated, not from a new attack against Gmail.
In a post on its official News from Google account on X, the company stated, “Reports of a ‘Gmail security breach impacting millions of users’ are false. Gmail’s defences are strong, and users remain protected.” The tech giant explained that the confusion arose from “a misunderstanding of infostealer databases,” which are repositories that compile credentials from multiple historic theft incidents across the internet.
The company emphasised that these data compilations do not reflect a current compromise of Gmail or any other Google service. It added that internal teams continuously monitor the web for large collections of exposed credentials and assist affected users by prompting password resets to safeguard their accounts.
The controversy was triggered after cybersecurity researcher Troy Hunt, who operates the breach notification service Have I Been Pwned, revealed that a massive 3.5-terabyte data set containing roughly 183 million email credentials had surfaced online. Hunt said the trove appeared to contain information aggregated from numerous past breaches, which may include Gmail addresses among other email providers. The discovery gained global traction after The New York Times reported on Hunt’s findings.
While Google insists Gmail itself remains secure, the company urged users to take additional precautions. It recommended enabling two-step verification, switching to passkeys for stronger authentication, and changing any credentials that may appear in leaked databases. The tech giant also reaffirmed that its automated systems actively detect large-scale credential dumps and work to resecure any affected accounts swiftly.
(Source: New York Times / Google, via X)
