Gmail Data Breach? Why It’s Usually Not Gmail That Leaked

Your phone buzzes. A password you saved “was found in a data breach”. The same evening a headline says 183 million Gmail passwords are out, and someone in the family group chat tells everyone to change everything.

Was Gmail hacked? In every widely reported case since 2014, no.

What leaked each time was a file of email addresses and passwords taken from somewhere else. A shopping site, a forum, an infected laptop. Gmail is everywhere, so gmail.com sits at the top of every one of those files when you sort by domain.

It topped the 183 million set, which is how that one became a “Gmail breach”. That’s all the headline is, and Google has said so, in writing, every time a claim named it.

Quick word on who’s writing. I run XposedOrNot, a free, open-source breach checker: type in an email, see which public breaches it’s in, no signup, nothing stored. The first-party numbers below come from our catalog of 796 breaches, pulled on 27 October 2026.

Everything else links to Google’s own pages or to the original research.

Was Gmail hacked? The plain answer

When a headline says “Gmail data breach”, what it’s nearly always describing is a file of stolen logins with a lot of gmail.com addresses in it, and nobody got into Google to make it. The addresses came from other sites’ breaches, mostly, plus recycled lists and the malware sitting on people’s own laptops. No widely reported “Gmail breach” between September 2014 and October 2026 involved Gmail or Google account systems, and Google has publicly denied every claim that named it.

Here’s Google’s wording from 27 October 2025, the week the “183 million” story ran: “Reports of a ‘Gmail security breach impacting millions of users’ are false.” The line after it explains the mix-up better than most news stories did: “The inaccurate reports are stemming from a misunderstanding of infostealer databases, which routinely compile various credential theft activity occurring across the web.”

So the addresses were real. The passwords next to them were often real too. They just didn’t come from Gmail.

How a “Gmail leak” gets made

Three kinds of file get called a Gmail leak. They’re different things, and the difference decides what you do next. (We compared them at length in an earlier post; the one-line version of each is below.)

A credential dump is one site’s breach: the shop or forum you signed up to with your Gmail address lost its user table, and your address was the username.

Then there’s the combolist, a recycled pile: someone merged dozens of old dumps into one text file of email and password pairs and passed it around. Nothing in it is new; the file is.

A stealer log is the nasty one. Malware on a laptop or phone recorded the logins typed on that device, with the site each was used on, and often the session cookies that keep you signed in. When that device’s owner logged into Gmail, the file got a gmail.com entry.

Mix those three and you’ve got a file with millions of rows. A big slice end in @gmail.com. Somebody sorts by domain, Gmail lands on top, and there’s your headline.

We see the same thing in our own index. Seven files in our catalog are aggregations of this kind (five combolists, one stealer-log collection and one hacking-forum dump our catalog types as a breach), and between them they hold 3,440,153,320 of our 11,717,192,990 records.

That’s 29% of everything we index as of 27 October 2026, and the other 789 entries are single-site breaches.

And the number of catalog entries whose name or domain is Google, Gmail or YouTube? Zero, out of 796. The biggest single file, the Collection #1 combolist, holds 790,803,860 unique addresses.

Our stealer-log source holds 299,646,818. Neither was a breach of anyone in particular, and both are full of Gmail addresses.

Records, not people, by the way. One address can sit in all seven files.

The big “Gmail breach” headlines since 2025, and what each one was

The 2014 precedent set the pattern. Back then it was five million “Gmail passwords” on a Russian forum, and Google’s security blog replied the same day with two lines that still cover it: no breach of Google systems, and under 2% of the pairs would even have worked.

Here are the six loudest waves since mid-2025, with what the data really was and what Google said:

When	The headline	What it actually was	Google’s response
Jun 2025, disclosed 5 Aug	The seed of “Google warns 2.5 billion Gmail users”	One Google corporate Salesforce CRM instance accessed by a voice-phishing crew. Business contact details of small-business customers, “basic and largely publicly available”	Google’s threat intelligence team disclosed it itself
Late Aug 2025	“Google warns 2.5 billion Gmail users to stop using passwords”	Nothing new. The June CRM story plus Google’s routine passkey push, rewritten as an emergency	1 Sep 2025, The Keyword: “This is entirely false.”
25 to 28 Oct 2025	“183 million Gmail passwords leaked”	A researcher’s stealer-log collection: 23 billion rows, 183 million unique addresses, 91% already seen in earlier breaches	Google on X, 27 Oct 2025: “Reports of a ‘Gmail security breach impacting millions of users’ are false.”
6 Nov 2025	“2 billion emails leaked”	A credential-stuffing list from the same researcher: nearly 2 billion addresses, 1.3 billion passwords	None. Nobody claimed Gmail was breached, though the headlines implied it
15 Dec 2025	“FBI confirms 630 million stolen passwords”	Passwords only, no emails, from devices the FBI seized from one suspect. Gmail isn’t mentioned anywhere in the story	None needed
23 to 26 Jan 2026	“48 million Gmail usernames and passwords leaked”	An unprotected 96 GB database of 149,404,754 logins with infostealer markers, found by a researcher. About 48 million ended in gmail.com	Google spokesperson: “a compilation of ‘infostealer’ logs, credentials harvested from personal devices by third-party malware”

There were two more in May and June 2025, the “184 million” and “16 billion” stories, which named Google alongside Apple and Microsoft. Same story underneath: exposed stealer-log databases, and no Google statement either time.

Since January there’s been nothing new of any size, and the “Google Gmail data breach 2026” pages you’ll find in search are vendor explainers recycling the 2025 and January numbers under a fresh year.

One of those six started life as a Google-side incident, and there was a second one the same summer that never reached the Gmail headlines. Both deserve precision. The June 2025 one was a sales database of business contacts.

The late-August one never made the Gmail headlines. Attackers stole OAuth tokens for a third-party chat tool and used them to read mail from “a very small number of Google Workspace accounts” that had the tool connected, per Google’s own write-up. Neither touched Gmail passwords.

Why the numbers are so big

Because stealer logs and combolists count rows, and rows aren’t people.

An infected laptop produces dozens of rows, one per site its owner logged into. A combolist repeats the same pair every time it’s merged into a new file. So “183 million” is 183 million unique addresses across a 23-billion-row pile, and 91% of them had been seen in earlier breaches already.

Only 16.4 million addresses in that set were new to any breach at all.

That’s also why these files keep working for criminals years later. The passwords in them were readable the day they leaked, because the sites that lost them stored them badly. In our catalog, 518 of 796 breaches leaked passwords, and 289 of those (55%) stored them in plain text or in a hash that cracks in minutes (our passwordRisk field, 27 October 2026; the full breakdown is here).

Add password reuse and you have the whole engine. Across 28.8 million users of 107 services, researchers at Virginia Tech found 52% reused or lightly modified a password between sites (ACM CODASPY 2018).

Google’s own survey put it at 52% reusing one password across several accounts (Harris Poll, February 2019). A password that leaked from a forum in 2016 still opens the Gmail account it was reused on, if nothing changed in between.

The attack has a name, credential stuffing: “repeated attempts to log in to online accounts using usernames and passwords stolen from other online services”, in the New York Attorney General’s definition. It doesn’t need Gmail to be breached. It needs you to have reused the password.

What Google means by “this password was found in a data breach”

This warning sends a lot of people searching for “Gmail data breach”, and it’s close to the opposite of one.

The feature is Password Checkup. It lives in Chrome and in your Google Account, and all it really does is hold each password you’ve saved up against the known leaked sets, then nag you about the ones it finds. Google’s help page puts it plainly: “Compromised passwords and username combinations are unsafe because they’ve been published online.”

So the warning means a password you saved, for some site, is sitting in one of those stolen-login files, and the leak happened wherever that password was used. Gmail is the messenger.

How often does it fire? When Google’s researchers measured it across 21 million logins (USENIX Security 2019), 1.5% of logins on the web involved a breached credential, and 26% of the warnings led the person to change the password. Three in four didn’t change it.

Was it Gmail? Four things you might see

What you saw	What it almost always is	Do this
A headline: “X million Gmail passwords leaked”	A combolist or stealer-log file that contains gmail.com addresses, not a breach of Google	Check your address against the actual breaches (below). Change passwords only where the list says they leaked
Google or Chrome: “this password was found in a data breach”	Password Checkup matched a saved password to a known leak from another site	Change that password on the site it belongs to, and anywhere you reused it
An email saying “you’ve been hacked”, quoting a real old password	A scam built on an old breach. The password is real, the hack isn’t	Don’t reply or pay. Retire that password everywhere it’s still live
A text or email saying your Gmail will close unless you act now	Phishing for your current Gmail password	Go to myaccount.google.com yourself. Never through the link

The first row fills the headlines. The third row costs people money, and it runs on exactly the same files.

What to do, in order

Fifteen minutes. Do them in this order, though. Change a password on an infected laptop and the malware has the new one before lunch.

1. Check the address, not the headline. Type your Gmail address into xposedornot.com. You get every breach it’s in, with what leaked each time. No signup, nothing stored. (If the list runs long, this guide to reading it oldest-first helps.)
2. If a stealer log is on the list, clean the device first. Our stealer-log entry almost always means a device your address was typed on was infected at some point, usually your own. Run a full malware scan on every computer and phone you sign in from, before you change anything. Google’s own hacked-account page puts “check for harmful software” on its list for the same reason.
3. Change passwords where they actually leaked, then anywhere you reused them. The breach list names the sites. Then run Google’s Password Checkup for anything saved in your browser. If you want to know whether one specific password is already circulating, our password check looks it up without the password ever leaving your browser.
4. Lock the Google account itself. Turn on 2-Step Verification, or skip ahead to a passkey if your phone supports one (nothing to type, so nothing to phish or reuse). Then open the devices list and sign out anything you don’t recognise (Google drops most sessions when you change the password, but keeps the devices it trusts to verify you, and connected apps keep their access), and go through forwarding rules, filters and connected apps in the Security Checkup.

Then stop reading headlines. Alert Me, our free breach alert, emails you when your address turns up in a newly indexed breach. If you’d rather your address didn’t show up in public searches at all, Privacy Shield hides it.

One more thing Google did in 2026. Its own breach-scan report was switched off on 16 February 2026 because, in Google’s words, it “didn’t provide helpful next steps”.

If you’ve been searching “google data breach check” and landing on a dead tool, that’s why. Password Checkup and Security Checkup are what’s left on Google’s side, and the four steps above are the next steps.

FAQ

How do you see if your Gmail password was leaked? Two checks, and they answer different questions. Put your address into XposedOrNot and you’ll see which sites leaked it, and whether a password came along; Google’s Password Checkup works the other way round, starting from the passwords you’ve saved and flagging the ones already in a known leak. If the Gmail password is on either list, change it today and switch on 2-Step Verification while you’re in there.

What are the signs that your Gmail has been hacked? The usual tells: a sign-in from somewhere you’ve never been, mail in Sent you didn’t write, a forwarding rule you never set, recovery details that aren’t yours any more, and Google’s “secure a hacked account” page goes through each of those. A headline about a Gmail leak isn’t a sign; a login you didn’t make is.

What does it mean when Google says my password was found in a data breach? A password you’ve saved in your Google Account turned up in a known leaked set, almost always from a breach of some other site where you used it, and that’s Password Checkup saying the password is out in the open, which is a different thing from Gmail being breached. Change it on the site it belongs to. Then (this is the bit people skip) go hunting for every other place you typed the same one.

Was there a Google data breach in 2026? Not of Gmail or Google accounts. The January 2026 “48 million Gmail logins” story was an unprotected database of infostealer logs found by a researcher, which Google described as “credentials harvested from personal devices by third-party malware”, and the later “2026” explainer pages recycle 2025 numbers.

Appendix: Sources and references

• Google on X (News from Google), 27 October 2025: “Reports of a ‘Gmail security breach impacting millions of users’ are false.” https://x.com/NewsFromGoogle/status/1982893232934793655 (the same wording was carried by BleepingComputer, The Register and Engadget that week)
• The Keyword, “Gmail’s protections are strong and effective, and claims of a major Gmail security warning are false”, 1 September 2025: https://blog.google/products/workspace/gmail-security-protections/
• Google Threat Intelligence Group, “The Cost of a Call: From Voice Phishing to Data Extortion”, 5 June 2025, with the 5 August 2025 update on Google’s own Salesforce instance: https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion
• Google Threat Intelligence Group, “Widespread Data Theft Targets Salesforce Instances via Salesloft Drift”, 27 to 28 August 2025: https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift
• Google Online Security Blog, “Cleaning up after password dumps”, 10 September 2014: https://security.googleblog.com/2014/09/cleaning-up-after-password-dumps.html
• Google spokesperson on the January 2026 database, as quoted by UNILAD Tech, 26 January 2026: https://www.uniladtech.com/news/tech-news/google-warns-48-million-gmail-logins-stolen-breach-910886-20260126
• Fox News, “149 million passwords exposed in massive credential leak”, 3 February 2026: https://www.foxnews.com/tech/149-million-passwords-exposed-massive-credential-leak
• Fox News, “Check if your passwords were stolen in huge leak”, 30 November 2025 (the 2 billion list): https://www.foxnews.com/tech/check-your-passwords-were-stolen-huge-leak
• Security Magazine on the FBI 630 million password corpus, December 2025: https://www.securitymagazine.com/articles/102054-630m-passwords-stolen-fbi-reveals-what-this-says-about-credential-value
• Google help, “Change compromised passwords in your Google Account” (Password Checkup): https://support.google.com/accounts/answer/9457609
• Google help, “Secure a hacked or compromised Google Account”: https://support.google.com/accounts/answer/6294825
• Google help, “Turn on 2-Step Verification”: https://support.google.com/accounts/answer/185839
• Google help, “Change or reset your password” (which devices stay signed in after a change): https://support.google.com/accounts/answer/41078
• Jeremiah Fowler via Website Planet, “Suspected InfoStealer Malware Data Breach Exposed 184 Million Logins and Passwords”, 22 May 2025: https://www.websiteplanet.com/news/infostealer-breach-report/
• Fox 29 on the June 2025 “16 billion” compilations, 20 June 2025: https://www.fox29.com/news/passwords-leaked-google-facebook-apple-breach
• Google help, “Sign in with a passkey instead of a password”: https://support.google.com/accounts/answer/13548313
• Google help, updates to Google’s breach-scan report (scans ended 15 January 2026, report removed 16 February 2026): https://support.google.com/websearch/answer/15191033
• Thomas et al., “Protecting accounts from credential stuffing with password breach alerting”, USENIX Security 2019: https://research.google/pubs/pub48399/
• Wang et al., “The Next Domino To Fall: Empirical Analysis of User Passwords across Online Services”, ACM CODASPY 2018: https://people.cs.vt.edu/gangwang/pass
• Das et al., “The Tangled Web of Password Reuse”, NDSS 2014: https://www.ndss-symposium.org/ndss2014/programme/tangled-web-password-reuse/
• Google and Harris Poll, “Online Security Survey”, February 2019: https://services.google.com/fh/files/blogs/google_security_infographic.pdf
• New York State Attorney General, “Business Guide for Credential Stuffing Attacks”, January 2022: https://ag.ny.gov/sites/default/files/businessguide-credentialstuffingattacks.pdf
• XposedOrNot catalog, 796 breaches and 11,717,192,990 records, pulled 27 October 2026 from api.xposedornot.com/v1/breaches (fields breachType, exposedRecords, passwordRisk, exposedData)
• Earlier posts: Breach Dump, Combolist, Stealer Log (/breach-dump-vs-combolist-vs-stealer-log/); 516 Breaches Leaked Passwords (/password-storage-analysis-2026/); Email Breach History (/email-breach-history/); 5 Things Worse Than a Leaked Password (/worse-than-a-leaked-password/); Introducing Stealer Log Coverage (/introducing-stealer-logs-alienstealer/)