Google denies reports of massive Gmail data breach

The search giant clarified that the alleged Gmail breach reports arose from old infostealer databases containing credentials from unrelated past hacks, emphasizing no new compromise of its systems has occurred

Google has denied claims of a massive Gmail data breach that allegedly exposed 183 million user accounts, calling the reports “false and misleading.” The tech giant clarified that no new security incident has occurred and that Gmail remains fully secure.

According to Google, the reports stem from a misunderstanding of so-called infostealer databases — collections of old login credentials stolen through unrelated malware attacks and historic breaches on various platforms. These resurfaced datasets, the company explained, were mistakenly linked to Gmail, even though they do not indicate a new compromise of Google’s systems.

In a post on X (formerly Twitter), Google stated, “Reports of a ‘Gmail security breach impacting millions of users’ are inaccurate. Gmail’s protections remain robust, and users are safe.” The company added that it continuously scans for leaked credentials and prompts affected users to change their passwords as a precaution.

Google urges users to stay vigilant

While confirming that Gmail itself was not breached, Google urged users to adopt stronger security measures, including enabling two-step verification, switching to passkeys, and using unique passwords across services. The company also reassured that it routinely implements automated defenses to detect suspicious login attempts and secure compromised accounts.

The rumor began after several online posts and media reports claimed a massive leak of Gmail passwords, sparking panic among users. However, security experts and Google’s official statement have since debunked the claims.

By swiftly addressing the issue, Google aimed to reassure its billions of Gmail users that the platform’s security infrastructure remains intact and that no evidence points to any recent compromise. The company reiterated its commitment to protecting user data and maintaining transparency in the event of any genuine threat.