A massive data breach has exposed approximately 183 million email accounts and their associated passwords, with Gmail users representing a significant portion of the compromised credentials. The breach, which originally occurred in April 2025, was recently revealed through the Have I Been Pwned (HIBP) breach-notification platform operated by Australian cybersecurity researcher Troy Hunt.
Source of the Breach
The stolen credentials were not obtained through a direct hack of Google’s servers or any single platform breach. Instead, the massive 3.5-terabyte dataset—equivalent to 875 full-length HD movies—was collected through infostealer malware infections across numerous compromised devices. Security firm Synthient LLC compiled the data from illicit online marketplaces and underground channels on Telegram where hackers distribute stolen credentials in bulk.
Scope of Compromised Data
The dataset, named “Synthient Stealer Log Threat Data,” includes 183 million distinct accounts, with approximately 16.4 million email addresses that had never appeared in any previous data breaches. The exposed information contains email-and-password combinations stored in plaintext alongside the websites where they were used. Affected accounts span multiple major email providers including Gmail, Yahoo, and Outlook.
How to Protect Your Account
Users can verify whether their credentials have been compromised by visiting HaveIBeenPwned.com and entering their email addresses. If flagged, the website provides details about the breach’s timing and nature. Security experts recommend immediate password changes for Google accounts and any other services using the same credentials. Enabling two-factor authentication is crucial, as it prevents hackers from accessing accounts even with stolen passwords.
Expert Analysis
Troy Hunt described this data as comprising both “stealer logs” and lists intended for credential stuffing, representing a shift from large, one-off platform breaches to a continuous stream of stolen credentials harvested via malware. Synthient analyst Benjamin Brundage noted that these findings highlight the extensive reach of infostealer malware, which often captures far more than just login credentials from infected devices.
