About 5 million Gmail addresses and passwords were leaked this week, sparking fears among many–even Yahoo Mail and Outlook email users–but people shoudln’t worry, Google says. There’s no evidence that any other email services other than Gmail were compromised in any way, and Google says it wasn’t hacked.
The password leak came likely via phishing scams and hacked websites.
But the leak, however, underscores that Gmail, Yahoo, and Outlook users should be wary of phishing scams. Users should also make sure their password is strong enough.
It was reported that 5 million Gmail accounts and passwords were dumped on a Russian Bitcoin forum last week, but the data is old, according to PC World and other reports.
Google said that users should not be too concerned about the leak.
“One of the unfortunate realities of the Internet today is a phenomenon known in security circles as “credential dumps”—the posting of lists of usernames and passwords on the web. We’re always monitoring for these dumps so we can respond quickly to protect our users. This week, we identified several lists claiming to contain Google and other Internet providers’ credentials,” it said in a blog post.
It added: “We found that less than 2% of the username and password combinations might have worked, and our automated anti-hijacking systems would have blocked many of those login attempts. We’ve protected the affected accounts and have required those users to reset their passwords. It’s important to note that in this case and in others, the leaked usernames and passwords were not the result of a breach of Google systems. Often, these credentials are obtained through a combination of other sources.”
PC World, citing the CSIS Security Group, reported that the Russian leaker says more than 60 percent of the data is legitimate.
“We can’t confirm that it is indeed as much as 60 percent, but a great amount of the leaked data is legitimate,” Peter Kruse, the chief technology officer of CSIS, told the website. “We believe the data doesn’t originate from Google directly,” Kruse added. “Instead it’s likely it comes from various sources that have been compromised.”