Key Highlights
- A data leak of 183 million account credentials has been confirmed.
- Email addresses and passwords from various accounts were included in the breach.
- Gmail login credentials have been compromised, according to Troy Hunt’s analysis.
- The stolen information consists of website URLs, email addresses, and passwords.
Data Leak Impacts 183 Million Accounts
In a significant cybersecurity incident, it has been confirmed that data from 183 million accounts was compromised in a breach. This massive leak includes email addresses and passwords, affecting users across various platforms. The incident was first disclosed on May 22, 2025, and more details emerged following its addition to Have I Been Pwned (HIBP), a popular database for tracking data leaks.
Analysis by Troy Hunt
Troy Hunt, the owner of HIBP, provided detailed insights into the leaked information. The data came from monitoring infostealer platforms over nearly a year and comprised 3.5 terabytes of information, with 23 billion rows of data in total. According to Benjamin Brundage from Synthient, the stolen credentials included website addresses, email addresses, and passwords.
Confirmation of Gmail Credentials
Hunt confirmed that a significant portion of the stolen information pertains to Gmail accounts. “Someone logging into Gmail,” Hunt wrote, “ends up with their email address and password captured against gmail.com.” This means that when an individual logs in, their credentials are recorded for future use by cybercriminals.
Recycled Credentials and Freshness
Hunt noted that most of the stolen information had been seen before, with 92% of the sample not being new. However, there is a significant portion of fresh data as well. Approximately 8%, or more than 14 million credentials, were previously unseen in any data breach.
Verification and Action
To ensure the accuracy of the leaked information, Hunt sent some details to people on the r/HaveIBeenPwned subreddit who are potentially impacted. One respondent validated that their Gmail account was indeed affected by the breach. HIBP advises all users to check if their account credentials might be included and to change them immediately if they are.
Given the scale of this data leak, it is crucial for individuals to take immediate action to secure their online accounts. The threat of credential stuffing attacks increases significantly in such scenarios, making it essential to update passwords across all affected platforms.
