Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Google Responds to Gmail Password Dump

Only a small percentage of the roughly five million password and username combinations recently dumped online would have allowed someone to access Gmail accounts, according to Google. 

Only a small percentage of the roughly five million password and username combinations recently dumped online would have allowed someone to access Gmail accounts, according to Google. 

The statement comes after a massive collection of passwords were posted online to a Russian Bitcoin forum along with a list of Gmail addresses. The information was published by someone under the username ‘Tvskit,’ who claimed that approximately 60 percent of the credentials are legitimate and that the majority of accounts belong to English, Spanish and Russian speakers.

However, Google said that less than two percent of the email and password combos could actually be used to access Gmail accounts.

“One of the unfortunate realities of the Internet today is a phenomenon known in security circles as “credential dumps”—the posting of lists of usernames and passwords on the web,” according to a post on Google’s security blog. “We’re always monitoring for these dumps so we can respond quickly to protect our users.”

“We found that less than 2% of the username and password combinations might have worked, and our automated anti-hijacking systems would have blocked many of those login attempts,” the blog continues. “We’ve protected the affected accounts and have required those users to reset their passwords.”

Advertisement. Scroll to continue reading.

There was no breach of Google’s systems, the company stated. Most likely, the leaked usernames and passwords were obtained through a combination of other methods, according to Google.

“For instance, if you reuse the same username and password across websites, and one of those websites gets hacked, your credentials could be used to log into the others,” the company noted. “Or attackers can use malware or phishing schemes to capture login credentials.”

Security specialist Peter Krause of the CSIS Security in Denmark tweeted that the credentials likely originated from a multitude of sources, and some were more than three years old.

“This is week is definitely a special one,” said Dmitry Bestuzhev, head of the global research and analysis team in Latin America at Kaspersky Lab. “On Monday somebody published supposedly leaked passwords from a Yandex email service, next day they did the same but with Mail.ru email service, publishing millions of leaked accounts. In both cases it was about accounts stolen via classic cybercrime schemes – phishing and malware attacks targeting the end point or the victims but not the provider itself. One important thing is that most of accounts are old.

“Today we’re seeing a new leak from Gmail,” he continued. “It looks like this is a planned action. Once again it’s likely that all passwords were stolen via classic attacks against the endpoint. One thing people can do to increase their access security is to enable two-factor authentication. So if the password is stolen, the account is not compromised.”

Written By

Marketing professional with a background in journalism and a focus on IT security.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.