Gmail users have been warned about a huge attack that appears to have left as many as 183 million email accounts insecure.
The data leaked online includes not only the email accounts themselves but the passwords believed to be associated with those logins.
The breach could allow hackers entry not only to email accounts but all of the other logins that depend on Gmail.
The breach occurred in April of this year but was recently noted by Have I Been Pwned, a website that tracks data breaches so that users can be alerted to them.
The data came from a much broader hack that was aggregated from across the internet, according to Troy Hunt, who runs the website.
Users are able to check whether their emails and passwords are part of the attack – or any other tracked data breaches – by using that website. In all, the website has tracked 917 breached websites and more than 15 billion accounts.
If a users’ account has been compromised, or might have been, then there are a series of relatively simple recommended actions. Users are advised to change their Gmail password as well as setting up two-factor authentication.
Two-step authentication adds an extra layer of security to an account so that even a hacker who has stolen a users’ password would not be able to get access with that alone. Unlike some other systems, Google uses a host of different second challenges, and says that its tools will choose the one that is most likely to keep hijackers out of an account.
Google’s own Password Manager Checkup tool also scans saved logins in Chrome and warns of weak, reused or breached passwords. The company said it automatically prompts password resets when large credential dumps are detected.
Researchers noted that most of the stolen credentials were likely harvested through fake software downloads, phishing attachments, or browser extensions. Victims often have no idea their devices were infected.
