Google Responds to Gmail Password Dump

Only a small percentage of the roughly five million password and username combinations recently dumped online would have allowed someone to access Gmail accounts, according to Google. 

The statement comes after a massive collection of passwords were posted online to a Russian Bitcoin forum along with a list of Gmail addresses. The information was published by someone under the username ‘Tvskit,’ who claimed that approximately 60 percent of the credentials are legitimate and that the majority of accounts belong to English, Spanish and Russian speakers.

However, Google said that less than two percent of the email and password combos could actually be used to access Gmail accounts.

“One of the unfortunate realities of the Internet today is a phenomenon known in security circles as “credential dumps”—the posting of lists of usernames and passwords on the web,” according to a post on Google’s security blog. “We’re always monitoring for these dumps so we can respond quickly to protect our users.”

“We found that less than 2% of the username and password combinations might have worked, and our automated anti-hijacking systems would have blocked many of those login attempts,” the blog continues. “We’ve protected the affected accounts and have required those users to reset their passwords.”

There was no breach of Google’s systems, the company stated. Most likely, the leaked usernames and passwords were obtained through a combination of other methods, according to Google.

“For instance, if you reuse the same username and password across websites, and one of those websites gets hacked, your credentials could be used to log into the others,” the company noted. “Or attackers can use malware or phishing schemes to capture login credentials.”

Security specialist Peter Krause of the CSIS Security in Denmark tweeted that the credentials likely originated from a multitude of sources, and some were more than three years old.

“This is week is definitely a special one,” said Dmitry Bestuzhev, head of the global research and analysis team in Latin America at Kaspersky Lab. “On Monday somebody published supposedly leaked passwords from a Yandex email service, next day they did the same but with Mail.ru email service, publishing millions of leaked accounts. In both cases it was about accounts stolen via classic cybercrime schemes – phishing and malware attacks targeting the end point or the victims but not the provider itself. One important thing is that most of accounts are old.

“Today we’re seeing a new leak from Gmail,” he continued. “It looks like this is a planned action. Once again it’s likely that all passwords were stolen via classic attacks against the endpoint. One thing people can do to increase their access security is to enable two-factor authentication. So if the password is stolen, the account is not compromised.”