Reports claimed 183 million Gmail accounts were breached. Google says Gmail was not breached. The data was stolen logins collected from many sites and infected devices.
Check your address on Have I Been Pwned, run Google Password Checkup, use a unique password and turn on two step verification or a passkey.
No. Every check and security tool in this guide is free.
None. We found no Gmail breach lawsuit or settlement. Be wary of anyone offering Gmail settlement money.
Headlines keep saying hundreds of millions of Gmail accounts were hacked. Google says that is false. The viral claim of 183 million Gmail passwords traces back to a huge pile of stolen logins collected from infected computers and many websites over years, not a break in at Gmail. Google has denied the reports more than once, according to BleepingComputer and The Register.
That does not mean you can ignore it. Those stolen logins are real, and reused passwords are the real risk. This guide separates what is true from what is hype, covers the real Google incident from 2025 and shows how to protect your account in a few minutes.
Quick answer
As of October 31, 2026, Google has not confirmed any breach of Gmail itself and calls the mass breach reports false. The 183 million figure was a collection of credentials stolen from infected devices and other sites. We found no Gmail breach lawsuit, settlement or claim form. Check your address on Have I Been Pwned, use a unique password and turn on two step verification or a passkey.
No breach of Gmail itself has been confirmed. Google said it had not sent a broad warning to all Gmail users and called that claim entirely false. Gmail addresses show up in leaked data because they are the most common email accounts in the world, and people use them to sign up for thousands of other sites.
When one of those sites is hacked, or when malware on a personal device records what someone types, the Gmail login can end up in a criminal collection. That is how Gmail addresses appear in breach lists without Google being hacked. CyberInsider explains that infostealer malware captures whatever a user types on an infected machine.
Over the weekend of October 25 and 26, 2025, news outlets reported that millions of Gmail accounts, and in some versions all 183 million, were breached. According to BleepingComputer, the story began when Troy Hunt, creator of Have I Been Pwned, added a collection of 183 million credentials supplied by threat intelligence platform Synthient to his service. Media outlets then reported it as a Gmail breach.
Google made a similar denial in September 2025 after outlets claimed 2.5 billion Gmail accounts were compromised. BleepingComputer reports that story stemmed from a Salesloft breach affecting a small number of Google Workspace accounts.
Google responded on X on October 27, 2025. Its statement read: “Reports of a ‘Gmail security breach impacting millions of users’ are false.” It added: “Gmail’s defenses are strong, and users remain protected.” The Register reports that Google blamed the confusion on a misunderstanding of infostealer databases and said it regularly scans for large caches of stolen credentials and prompts affected users to reset passwords when needed.
Yes, a different one. Google confirmed that a breach of one of its corporate Salesforce databases, used to reach prospective Google Ads customers, exposed a limited set of data. TechRadar reports the activity happened in June 2025. The attackers were identified as the group ShinyHunters.
Anyone who got a sales call or email from someone claiming to be from Google may want to be careful. Contact details taken from a sales database are exactly what scammers use to sound believable. See our guide to class action settlement scams for warning signs.
We found no class action over a Gmail data breach. There is a separate privacy case. Insurance Journal reports that a proposed class action called Thele v. Google LLC, Case No. 25-cv-09704, was filed in the U.S. District Court for the Northern District of California in November 2025. It alleges Google secretly turned on its Gemini AI tool for Gmail, Chat and Meet and violated the California Invasion of Privacy Act.
Important: The Gemini case is about privacy settings, not stolen data, and its allegations are unproven. We found no ruling or settlement. Do not trust any message offering to claim Gmail settlement money or asking you to pay a fee to join a lawsuit.
To understand how these cases work, read what a class action lawsuit is and how to join a class action lawsuit. You can also browse open class action settlements you can claim today.
Tip: Treat any email or text about a Gmail breach that pushes you to act fast or click a link as suspicious. Go to your Google Account directly instead of clicking the link.
Big breach headlines about Gmail will likely keep returning, because stolen password collections keep growing and are often reported as new events. We will update this page if Google confirms a real breach, a court rules in the Gemini case or a settlement is announced.
No. Google said reports of a Gmail security breach impacting millions of users are false and that Gmail's defenses remain strong. The viral 183 million figure came from a collection of passwords stolen over years from infected computers and many websites, not from a hack of Gmail itself.
Threat intelligence firm Synthient gathered credentials from infostealer malware logs and credential stuffing lists, and Have I Been Pwned founder Troy Hunt added 183 million unique email and password pairs to his service. The pairs cover many email providers and thousands of sites, and about 91 percent had been seen in earlier leaks.
Google says it did not send a broad warning telling all Gmail users to change passwords. Still, changing a password is smart if it is reused on other sites, appears in a breach check, or you have ever had malware on your device. Turn on two step verification or a passkey either way.
Search your email address on Have I Been Pwned and open the Stealer Logs section after verifying your address. You can also run Google Password Checkup to see whether any saved passwords are known to be compromised.
Yes, a separate one. Google confirmed that hackers got into one of its corporate Salesforce databases used for sales contacts, and the exposed data was limited to business names, phone numbers and related notes. Google said Gmail and Google Ads accounts were not affected.
We found no class action over a Gmail data breach. A separate proposed class action, Thele v. Google LLC, was filed in November 2025 over Gemini AI features in Gmail, Chat and Meet. It is a privacy case, not a data breach case, and the claims are unproven.
No. There is no Gmail breach settlement, claim form or payout. Any message offering money from a Gmail breach settlement is a scam.
Sources: BleepingComputer, The Register, CyberInsider, TechRadar, Insurance Journal. This page is for information only and is not legal advice.