183M Gmail Passwords Leaked
14 comments
·October 28, 2025Semaphor
jcattle
So it is not a breach, but a collection of many sources.
It is 183 million email (not gmail) addresses in the collection of which 14M haven't been seen before on have i been pwned.
This hackernews title should be changed. (Currently: 183M Gmail Passwords Leaked)
larholm
The title of the article makes it clear that these are not 183M Gmail passwords, but that Gmail passwords are a part of the leak.
"Gmail Passwords Confirmed As Part Of 183 Million Account Data Leak"
EForEndeavour
By the article's logic, I just exhaled 5 * 10^18 kg of carbon dioxide into the earth's atmosphere.
nomilk
Some apps reset your password automatically (send you a password reset email) if they detect it has been leaked.
But email services appear to have a harder problem due to the catch 22 where you can't log in to reach the password reset email if they were to reset your password.
What do they do?
bfkwlfkjf
Maybe recovery email. Gmail once in a while asks me to set one up.
charcircuit
Ignoring the backup email case as the other commentor left. In practice accounts are not immediately compromised so there is enough time to send a reset to the original user.
You could also do things like having the reset require the user to have a token that was issued before the compromise to prove you were able to authenticate before the leak happened.
comrade1234
I skimmed the article. I skimmed several of the linked articles. No one says the source of the credentials, other than where people are buying and selling them. Where are google login credentials coming from? Malware I assume and nothing to do with a problem at google?
bfkwlfkjf
Uh oh. For a long time I've been giving myself the excuse that the only reason why I keep using Gmail is security - Google has never had these kind of breaches.
The argument is no longer valid, time to move off Gmail.
jsnell
There was no breach, which is clear from the first sentence of the article.
Moru
If I understood the follow up blogpost right, it states that there is a lot of email adresses where the only hit is the email domain so they are filtering away that as false positives. Not all stolen credentials are properly aligned and encoded with ; on the correct place I guess :-)
There might be a lot less gmail adresses showing up as pwned now.
blitzar
sex, love, secret, and god
Those are mine
readthenotes1
Please be careful when typing in the name of God. It could have devastating consequences.
I hope you're using a site that requires at least 6 (but no more than 10) uppercase, lowercase, numeric, and special characters.
IAmBroom
Scott Alexander, that you?
https://www.troyhunt.com/inside-the-synthient-threat-data/
Primary article instead of shitty forbes blog spam.