Gmail breach panic? It’s a misunderstanding, not a hack

Gmail breach panic? It’s a misunderstanding, not a hack, according to Google, which denied that Gmail systems had suffered a breach after media outlets misinterpreted an interview with a security researcher. The article notes reporters claimed the incident took place in April, but the researcher said there was a large amount of Gmail usernames and passwords circulating on the dark web, which are two different things.

It explains that credentials come from many past attacks and breaches over the years, and that cybercriminals buy and sell databases containing stolen data to enable broader or more targeted attacks. The piece warns that such reporting can spur unnecessary panic, and urges readers to verify their exposure using Malwarebytes’ Digital Footprint scanner and to change passwords and enable two-factor authentication where possible.

It also highlights that the activity described is not reflective of a new attack aimed at any one person, tool, or platform, but rather a general phenomenon of credential theft databases.