Google has been hacked – Change your passwords!

Roughly 16 million new credentials added to the stealer logs.

Earlier this year, it was reported that a data leak that included a whopping 184,162,718 passwords and logins impacting the likes of Apple, Facebook and Instagram users. That data leak was disclosed on May 22, and now, in a rather spooky seeming coincidence, news of 183 million passwords and login credentials from an April 2025 breach has emerged. Adding the details of website URLs, email addresses and passwords to the Have I Been Pwned database, owner Troy Hunt said the data consisted of both “stealer logs and credential stuffing lists” including confirmed Gmail login credentials.

The total amount of information sent to HIBP comprised 3.5 terabytes of data, 23 billion rows of it in all. The output of the stealer logs concerned, Hunt said (from Have I Been Pwned), consisted primarily of three things: website address, email address and password. “Someone logging into Gmail,” Hunt wrote, “ends up with their email address and password captured against gmail.com, hence the three parts.” Of course, there’s a lot of recycling of credentials that goes on in the cybercriminal world, so Hunt initially wanted to check the freshness of the database he had in his hands.

An analysis of a 94k sample revealed 92% were not, in fact, new. “Most of what has been seen before was in the ALIEN TXTBASE stealer logs,” Hunt confirmed. However, the math wizards out there will have noted that this steal leaves 8% that is new and fresh, or more than 14 million credentials if you extrapolate it. Actually, the final tally was 16.4 million previously unseen addresses in any data breach, not just stealer logs.

Of course, it is not just Gmail users who will be impacted by this leak, so I would advise everyone to go and check at HIBP to see if their account credentials might be included.