Google was as soon as once more compelled to announce that it had not suffered a data breach after quite a few information shops revealed sensational tales a few pretend breach that purportedly uncovered 183 million accounts.
This declare started over the weekend and into in the present day, with information tales claiming that hundreds of thousands of Gmail accounts had been breached, with some shops saying it affected the total 183 million accounts.
Nevertheless, as the corporate defined in a sequence of posts on Monday, Gmail didn’t endure a breach, and the compromised accounts had been really from a compilation of credentials stolen by information-stealing malware and different assaults over time.
“Studies of a ‘Gmail security breach impacting hundreds of thousands of customers’ are false. Gmail’s defenses are robust, and customers stay protected,” reads a publish on X.
“The wrong experiences are stemming from a misunderstanding of infostealer databases, which routinely compile numerous credential theft exercise occurring throughout the online. It isn’t reflective of a brand new assault aimed toward anyone particular person, software, or platform.”
“A number of inaccurate claims surfaced not too long ago that incorrectly acknowledged that we issued a broad warning to all Gmail customers a few main Gmail security challenge. That is totally false,” Google added.
That is simply the most recent such story that quite a few information web sites and cybersecurity firms have reported with out verification lately.
This explicit story stems from Have I Been Pwned (HIBP) creator Troy Hunt asserting he not too long ago added a large assortment of 183 million compromised credentials to the data breach notification platform shared by the menace intelligence platform Synthient.
These credentials weren’t stolen in a single data breach, however fairly by way of information-stealing malware, data breaches, credential stuffing, and phishing. Moreover, these accounts will not be for a single platform however for hundreds, if not hundreds of thousands, of web sites.
Risk actors generally acquire uncovered credentials and mix them into huge collections, that are then shared among the many cybercrime group on Telegram channels, Discord servers, and hacking boards.
After loading the info into HIBP, Hunt says 91% of the 183 million credentials had beforehand been seen, illustrating that a lot of them have been circulating for years.
“The ultimate quantity as soon as the complete knowledge set was loaded into HIBP was 91% pre-existing, with 16.4M beforehand unseen addresses in any data breach, not simply stealer logs,” defined Hunt.
Firms, together with Google, generally use collections like these to warn prospects of uncovered passwords and to power password resets to guard accounts.
“Gmail takes motion once we spot giant batches of open credentials, serving to customers reset passwords and resecure accounts,” defined Google.
Whereas the claims of a Gmail data breach are false, that doesn’t imply uncovered credentials are innocent or must be ignored, as menace actors generally use them to breach company networks and perform devastating assaults.
For instance, the UnitedHealth Change Healthcare ransomware assault was attributable to uncovered Citrix credentials that enabled menace actors to realize preliminary community entry.
Nevertheless, experiences of unfounded data breaches don’t assist anybody and solely trigger undue stress and further work for a platform’s customers and enterprise prospects.
Simply final month, Google needed to state that it didn’t endure a data breach after the identical information websites claimed that 2.5 billion Gmail accounts had been compromised.
Whereas that declare stemmed from a Salesloft breach that impacted a small variety of Google Workspace accounts, the story was shortly sensationalized right into a a lot bigger breach.
In case you are involved that your credentials could have been a part of the Synthient assortment, you possibly can register an account at Have I Been Pwned, open the dashboard, and click on Stealer Logs to see in case your account was compromised prior to now by information-stealing malware.
If in case you have accounts listed, carry out an antivirus scan in your laptop, then instantly change the passwords for your whole accounts.
46% of environments had passwords cracked, almost doubling from 25% final yr.
Get the Picus Blue Report 2025 now for a complete have a look at extra findings on prevention, detection, and knowledge exfiltration tendencies.
