5 Million Gmail Accounts Hacked & Leaked Publicly!

Written by: ‘M’

Beware Gmail users, your usernames and passwords were probably leaked online! That’s right, approximately 5-million Gmail account credentials, both e-mail address and password, have been embezzled, then, made available for the public through an online forum, which caused a large number of users worldwide to change their Gmail password again. The website which published the links to the stolen e-mail credentials seemed to have been a Russian forum website. The credentials were also aforementioned to be old and likely sourced from consecutive data breaches beforehand. It is believed that the leaked passwords are not necessarily those used to access Gmail accounts, but seem to have been accumulated from other websites where users used their Gmail addresses to register.

Yes, It’s Russian!

The news was received with great shock the time when a user posted a link to the stolen e-mail credentials on Reddit. This particular section of Reddit was frequented by hackers, both amateur and professional. The archive file containing nearly 5-million Gmail credentials, both e-mail addresses and plain text passwords was posted on a Russian Bitcoin security forum known as btcsec.com on Tuesday night by a user with an alias known as “tvskit”, which is a Russian news outlet (C News). The user who exposed Gmail user’s credentials said that almost 4.93 million accounts allegedly affected belonged to English, Russian and Spanish users and claimed that over 60 percent of accounts are active. This means, there is a silver lining in this leak, i.e., 40 percent of the passwords are invalid or out of date, which could be a good news for those Gmail users who have recently changed their passwords and are concerned about their account’s security – there’s a chance that they’re not at risk at all.

“We can’t confirm that it is indeed as much as 60 percent, but a great amount of the leaked data is legitimate.”, said Peter Kruse, the chief technology officer of CSIS Security Group.

Google Denies Security Breach

Google, in its defense, believes that the usernames and passwords didn’t come from a security breach of its system. That means, the credentials had been stolen by phishing campaigns, keyloggers, and unauthorized access to user accounts.

“It’s important to note that in this case and in others, the leaked usernames and passwords were not the result of a breach of Google systems,” Google, which operates Gmail e-mail service, explained in a post on its online security blog. “Often, these credentials are obtained through a combination of other sources.”

“We found that less than 2% of the username and password combinations might have worked, and our automated anti-hijacking systems would have blocked many of those login attempts. We’ve protected the affected accounts and have required those users to reset their passwords.”, said Google.

The leaked passwords not only give access to users’ Gmail accounts, but other Google services as well, including Google Drive, and the mobile payment system Google Wallet.

Defend Yourself!

There are numerous things you can do to defend yourself from this information leak, if you are a Gmail user, that is.

• A website called com allows users to check if their email address is among those leaked. People who are concerned about the security of their account are advised to go ahead and change their password.

• Have Google two-factor authentication (2FA) enabled and recommend you same to do this for Google and other accounts. Many web services, including Gmail, Facebook, Twitter, Dropbox, Github and AWS, offer 2FA option, a security measure where users are required to provide a passcode sent to their mobile devices before any changes can be made to their account. This would prevent an attacker from logging in without access to a user’s smartphone.

Links: Protect your PC and mobile devices from hackers & governments and surf anonymously 

________________________________________________________________________

Sources:

http://thehackernews.com/2014/09/5-million-gmail-username-password.html