A massive data leak has exposed passwords for over 183 million email accounts, including tens of millions of Gmail addresses, in one of the largest credential dumps on record.
The 3.5-terabyte dataset surfaced online this month, compiled from a year of “infostealer” malware that quietly harvests login details from infected devices. Cybersecurity expert Troy Hunt, creator of Have I Been Pwned, confirmed the breach includes 183 million unique credentials, with 16.4 million email addresses appearing for the first time in any known leak.
Users can check if their accounts are affected by visiting HaveIBeenPwned.com.
While many entries are recycled from older breaches, millions of newly compromised Gmail passwords were verified as active by affected users. Security firm Synthient traced the data to criminal marketplaces and Telegram channels where hackers trade stolen information.
Google stressed that Gmail was not directly hacked. “These credentials come from infostealer malware, not a breach of our systems,” a spokesperson said, urging users to enable two-factor authentication (2FA) and switch to passkeys.
Experts warn that password reuse amplifies the risk, enabling attackers to access banking, social media, and other accounts through automated “credential stuffing” attacks.
Cybersecurity analysts recommend:
– Immediately changing exposed passwords
– Using unique passwords for every account
– Enabling 2FA everywhere possible
– Storing credentials in encrypted password managers
– Avoiding browser-based password saving
The leak underscores the growing threat of infostealer malware spread via phishing, fake downloads, and malicious extensions. Google’s Security Checkup and Password Manager tools can help users detect and fix compromised or weak credentials.
