Headlines keep saying hundreds of millions of Gmail accounts were hacked. Google says that is false. The viral claim of 183 million Gmail passwords traces back to a huge pile of stolen logins collected from infected computers and many websites over years, not a break in at Gmail. Google has denied the reports more than once, according to BleepingComputer and The Register.
That does not mean you can ignore it. Those stolen logins are real, and reused passwords are the real risk. This guide separates what is true from what is hype, covers the real Google incident from 2025 and shows how to protect your account in a few minutes.
Quick answer
As of October 31, 2026, Google has not confirmed any breach of Gmail itself and calls the mass breach reports false. The 183 million figure was a collection of credentials stolen from infected devices and other sites. We found no Gmail breach lawsuit, settlement or claim form. Check your address on Have I Been Pwned, use a unique password and turn on two step verification or a passkey.
Was Gmail Actually Breached?
No breach of Gmail itself has been confirmed. Google said it had not sent a broad warning to all Gmail users and called that claim entirely false. Gmail addresses show up in leaked data because they are the most common email accounts in the world, and people use them to sign up for thousands of other sites.
When one of those sites is hacked, or when malware on a personal device records what someone types, the Gmail login can end up in a criminal collection. That is how Gmail addresses appear in breach lists without Google being hacked. CyberInsider explains that infostealer malware captures whatever a user types on an infected machine.
Where Did the 183 Million Gmail Passwords Claim Come From?
Over the weekend of October 25 and 26, 2025, news outlets reported that millions of Gmail accounts, and in some versions all 183 million, were breached. According to BleepingComputer, the story began when Troy Hunt, creator of Have I Been Pwned, added a collection of 183 million credentials supplied by threat intelligence platform Synthient to his service. Media outlets then reported it as a Gmail breach.
What the data really was:
- Not one breach. The credentials were gathered over years through infostealer malware, past data breaches, credential stuffing and phishing.
- Many sites, not just Gmail. The pairs span many email providers and thousands of websites.
- Mostly old. About 91 percent of the credentials had been seen before, and about 16.4 million addresses were new to Have I Been Pwned.
- Huge source pile. Per CyberInsider, Synthient's collection was over 3.5 terabytes and 23 billion rows before it was reduced to 183 million unique email and password pairs.
Google made a similar denial in September 2025 after outlets claimed 2.5 billion Gmail accounts were compromised. BleepingComputer reports that story stemmed from a Salesloft breach affecting a small number of Google Workspace accounts.
What Did Google Say About the Gmail Data Breach?
Google responded on X on October 27, 2025. Its statement read: “Reports of a ‘Gmail security breach impacting millions of users’ are false.” It added: “Gmail’s defenses are strong, and users remain protected.” The Register reports that Google blamed the confusion on a misunderstanding of infostealer databases and said it regularly scans for large caches of stolen credentials and prompts affected users to reset passwords when needed.
Did Google Have a Real Data Breach?
Yes, a different one. Google confirmed that a breach of one of its corporate Salesforce databases, used to reach prospective Google Ads customers, exposed a limited set of data. TechRadar reports the activity happened in June 2025. The attackers were identified as the group ShinyHunters.
The Google Salesforce incident:
- What was taken: Business names, phone numbers and related notes used by sales agents to follow up with prospects, per Google.
- What was not affected: Google said payment information was not exposed, and Google Ads, Merchant Center and Google Analytics accounts were not affected, as reported by BleepingComputer.
- How many records: Google did not disclose a number. The hackers claimed about 2.55 million records, which may include duplicates.
- Gmail passwords: Neither report says Gmail passwords were involved.
Anyone who got a sales call or email from someone claiming to be from Google may want to be careful. Contact details taken from a sales database are exactly what scammers use to sound believable. See our guide to class action settlement scams for warning signs.
Is There a Google Gmail Data Breach Lawsuit?
We found no class action over a Gmail data breach. There is a separate privacy case. Insurance Journal reports that a proposed class action called Thele v. Google LLC, Case No. 25-cv-09704, was filed in the U.S. District Court for the Northern District of California in November 2025. It alleges Google secretly turned on its Gemini AI tool for Gmail, Chat and Meet and violated the California Invasion of Privacy Act.
Important: The Gemini case is about privacy settings, not stolen data, and its allegations are unproven. We found no ruling or settlement. Do not trust any message offering to claim Gmail settlement money or asking you to pay a fee to join a lawsuit.
To understand how these cases work, read what a class action lawsuit is and how to join a class action lawsuit. You can also browse open class action settlements you can claim today.
How Do You Check If Your Gmail Was Exposed?
Check your account in three steps:
- Search your email on Have I Been Pwned. Go to haveibeenpwned.com, verify your address and open the Stealer Logs section.
- Run Google Password Checkup. Open Google Password Manager to see whether saved passwords are known to be compromised, reused or weak.
- Run Security Checkup. Use the Google Security Checkup to review devices, recent activity and recovery options.
What Should You Do to Protect Your Gmail Account?
Steps to take now:
- Turn on two step verification. Follow the Google 2 Step Verification guide.
- Switch to a passkey. Passkeys are much harder to phish than passwords because there is no password to type into a fake site. See Google's authentication page.
- Use a unique password for Gmail. Never reuse your email password on shopping, social or streaming sites.
- Change reused passwords. If your Gmail password is also used elsewhere, change every copy, starting with banking.
- Scan for malware. If your address appears in Stealer Logs, run an antivirus scan before changing passwords so the new ones are not captured.
- Update your recovery phone and email. Remove old devices and numbers you no longer use.
- Report scams. Report phishing at ReportFraud.ftc.gov and identity theft at IdentityTheft.gov.
Tip: Treat any email or text about a Gmail breach that pushes you to act fast or click a link as suspicious. Go to your Google Account directly instead of clicking the link.
Google Gmail Data Breach Timeline
Key dates:
- June 2025: Hackers access one of Google's corporate Salesforce databases, per TechRadar.
- August 2025: Google confirms the Salesforce incident and says the data was limited to business contact details.
- September 2025: Reports claim 2.5 billion Gmail accounts were compromised. Google denies it.
- October 25 and 26, 2025: Reports spread that 183 million Gmail accounts were breached after a Have I Been Pwned update.
- October 27, 2025: Google says the reports are false.
- November 2025: Thele v. Google LLC, a Gemini privacy class action, is filed in California.
- October 31, 2026: We find no confirmed Gmail breach, lawsuit over one, or settlement.
What Happens Next?
Big breach headlines about Gmail will likely keep returning, because stolen password collections keep growing and are often reported as new events. We will update this page if Google confirms a real breach, a court rules in the Gemini case or a settlement is announced.
Frequently Asked Questions About the Google Gmail Data Breach
No. Google said reports of a Gmail security breach impacting millions of users are false and that Gmail's defenses remain strong. The viral 183 million figure came from a collection of passwords stolen over years from infected computers and many websites, not from a hack of Gmail itself.
Threat intelligence firm Synthient gathered credentials from infostealer malware logs and credential stuffing lists, and Have I Been Pwned founder Troy Hunt added 183 million unique email and password pairs to his service. The pairs cover many email providers and thousands of sites, and about 91 percent had been seen in earlier leaks.
Google says it did not send a broad warning telling all Gmail users to change passwords. Still, changing a password is smart if it is reused on other sites, appears in a breach check, or you have ever had malware on your device. Turn on two step verification or a passkey either way.
Search your email address on Have I Been Pwned and open the Stealer Logs section after verifying your address. You can also run Google Password Checkup to see whether any saved passwords are known to be compromised.
Yes, a separate one. Google confirmed that hackers got into one of its corporate Salesforce databases used for sales contacts, and the exposed data was limited to business names, phone numbers and related notes. Google said Gmail and Google Ads accounts were not affected.
We found no class action over a Gmail data breach. A separate proposed class action, Thele v. Google LLC, was filed in November 2025 over Gemini AI features in Gmail, Chat and Meet. It is a privacy case, not a data breach case, and the claims are unproven.
No. There is no Gmail breach settlement, claim form or payout. Any message offering money from a Gmail breach settlement is a scam.
Sources: BleepingComputer, The Register, CyberInsider, TechRadar, Insurance Journal. This page is for information only and is not legal advice.
Impacted Data:
- Email addresses and passwords in the 183 million credential collection (stolen from infected devices and other sites, not from Gmail servers)
- Business names, phone numbers and sales notes in the Google Salesforce incident
- Not affected per Google: payment information and Google Ads, Merchant Center and Analytics accounts
Google Gmail Data Breach Notice
We found no breach notice sent to Gmail users, because Google says Gmail was not breached. Google’s public statement on X is the closest thing to an official notice. The Register and BleepingComputer both quote it.
What Google has said officially:
- October 27, 2025: Google said reports of a Gmail security breach impacting millions of users are false and that Gmail's defenses remain strong.
- Salesforce incident: Google did confirm a separate breach of a corporate Salesforce database. Contact details of affected prospects were limited to business information, per Google.
- No customer notice for Gmail: We found no notice letter, state attorney general filing or claim form tied to a Gmail breach.
Impacted Data:
● Email Address
● Password
● Business Name
● Phone Number
● Sales Notes