5 million Gmail usernames, passwords posted on Russian forum

[A Guy]

Nearly 5 million Gmail usernames and passwords have reportedly been leaked on a Russian Bitcoin forum.

A massive list of account names and their passwords was posted Tuesday on btcsec.com, CNews reported.

Google claims that the majority appear to be out of date and invalid. But one forum user named tvskit — who posted a screen shot of several crossed-out accounts — contends that of the 4,929,090 records, more than 60% of their corresponding passwords are valid.

The full list appeared to have been removed from the Russian-language website by Wednesday.

A Google representative, speaking with the Daily News, said the private information could have been stolen over the course of years via phishing and hacking of individual accounts.

Source

A Guy

 

[Anak]

Here's one site if anyone wants to check theirs: https://isleaked.com/en

What I like about this checker is it allows you to substitute three characters of your real email address with asterisks. * * *

 

[Callender]

Gmail hacked

That's very handy - thank you. My account seems unaffected!

 

[RoasterMen]

How about my account? What the hell these Russians should stop these things or I will hack their sites myself!

 

[Anak]

That's very handy - thank you. My account seems unaffected!

Your welcome, mine also!

How about my account? What the hell these Russians should stop these things or I will hack their sites myself!

Go for it!

 

[ThrashZone]

Nifty site Anak

 

[andrew129260]

Thanks anak

Site info:

https://who.is/whois/https://isleaked.com/en

http://whois.domaintools.com/isleaked.com

 

[Anak]

You're all welcome guys.

I didn't hear about the google hit until this evenings news, and after reading A Guy's lead story I searched some more and noticed three other articles with checkers that wanted you to use your full addy. I thought uh–oh, no, I'm not going to use them.

Actually, the one I linked to is at the bottom of A Guy's source link. So he deserves the credit. I have 2-Step Verification so I didn't think I would see a bad result.

Even without the 2-step, google will throw an alert to you if they notice an odd IP addy in your sign-in details, but you have to make the setting.
After you sign-in, look to the lower right corner of your page; you'll see, Last account activity: X minute(s) ago Details. Just click on Details and you'll see your most recent log-ons, then below that is a Alert preference setting to alert you to any unusual activity.


Safe Surfin'



EDIT:
Grammatical errors? I hope this post reads better after my rewrite. It was getting late for me; I must have been ghost writing, and in'

 

[andrew129260]

Very good info to note anak.

 

[Solarstarshines]

Mine is good thanks for the heads up

 

[A Guy]

Yes, that site is mentioned in the original story

A Guy

 

[andrew129260]

Google Online Security Blog: Cleaning up after password dumps

From the article. See above, they state:

We found that less than 2% of the username and password combinations might have worked, and our automated anti-hijacking systems would have blocked many of those login attempts. We’ve protected the affected accounts and have required those users to reset their passwords.

It’s important to note that in this case and in others, the leaked usernames and passwords were not the result of a breach of Google systems. Often, these credentials are obtained through a combination of other sources.

 

[ThrashZone]

Thanks Bill I didn't read the article
I did change my password anyway though it's been the same for some time now = years

 

[alikhan]

If you are using 2-step verification then its nothing to worry. Also i am using lastpass generated passwords. It would be hard to decrypt when you are using 16-word random characters along with special symbols.

 

[ThisIsMadness91]

My account wasn't affected, but I may change my password just to be safe, and look into two-step verification while I'm at it.

 

[andrew129260]

2 step verification is almost a necessity now. It is a quick and painless thing to use and set up. And it really increases security. I wish banks would start doing this.

 

[matts6887]

Here's one site if anyone wants to check theirs: https://isleaked.com/en

What I like about this checker is it allows you to substitute three characters of your real email address with asterisks. * * *

Thanks for the link Anak; very handy indeed. And thankfully it looks like mine is not one of the ones affected. Argg; I; like i am sure countless others; wish I could reach through into the net and strangle the living ***** outta the hackers responsible for causing problems for us. Gotta love to hate technology sometimes.

 

[matts6887]

2 step verification is almost a necessity now. It is a quick and painless thing to use and set up. And it really increases security. I wish banks would start doing this.

I agree Andrew. 2 step security would greatly step up security and make it that much harder and hopefully that much more of a hassle for hackers, thieves, etc. to try and get access to info etc that is not theirs. And yea banks should start doing that and i am sure it makes one wonder why they have not already done so. They claim they have several security measures in place but I really wonder about how true that really is.

 

[The Howling Wolves]

Just changed my password to "AGuyfor7F" on my laptop then on
desktop I changed it to "password2hack"

Just joking of course.

 

[ThrashZone]

Banks do have a version of two step and is usually activated if connecting from a different machine or location outside your city or state,
It's basic personal question similar to accessing your account on phone support but still pretty good,
And yes they also usually have your cell and home number and can send password reset to you via email or text message
I personally wouldn't give Google a cell number if you paid me
email password resets... are perfectly fine via email messaging.