Google Gmail digital mail users have been warned of a data breach, as more than 183 million passwords allegedly stolen in ‘mammoth’ data breach.

Users are encouraged to review their accounts and change their passwords as soon as possible.

Australian cybersecurity expert Troy Hunt revealed the incident. He characterized it as a massive set of breached data, total volume of 3.5 terabytes – equivalent to approximately 875 full-length high-definition (HD) movies.

Hunt told the DailyMail the data breach included “all major email providers” – not just Gmail, but Outlook, Yahoo and others. As he told the Daily Mail, “They come from anywhere you can imagine, but Gmail comes up very often.”

If you have emails registered with Yahoo, Outlook, Gmail or any other provider, it is important to check if your password has been leaked now.

Users are encouraged to go to Troy Hunt’s Have I Been Pwned website to enter their email address in the search bar. The site will show you if your address has been involved in breaches in the past decade.

If you have been affected, it is recommended that you immediately change your password and activate it two-factor authentication (2FA – two different forms of verification for entering an account);

The incident happened in April 2025, but was only now revealed to the public by the Australian expert.

Your email account password isn’t the only thing that might have been compromised, the expert warned.

Unique passwords associated with your email account that you use on other websites; such as Amazon, eBay and Netflix, are also at risk.

According to Hunt the leak is not due to a single incident, but a collection of “stealer logs” – data files created by malware. The identity of the hackers remains unknown at this time.

What is 2FA?

2-factor authentication (2FA) is a two-factor authentication that adds an extra layer of security to an account by asking for not only the password but also a second identifier, such as a code sent to your mobile or generated by an app. Even if someone steals your password, they won’t be able to log in without the second item.

Common methods

  • Codes via SMS:

    A one-time password (OTP) is sent via SMS to your mobile phone.

  • Authenticator apps:

    An app on your phone generates one-time codes that are constantly refreshed.