Cybersecurity experts have revealed that data containing usernames and passwords of nearly 48 million Gmail users has been leaked.
According to cybersecurity researchers the database was neither password-protected nor encrypted and contained around 96GB of raw login credential data.
The investigation found that this information was not the result of a direct hack of Gmail or other online services. Instead it consisted of data collected over time from previous breaches and through infostealer malware.
Experts explained that infostealer malware infects users’ personal devices and secretly records usernames, passwords, and other sensitive information.
The leaked database included not only Gmail accounts but also login details for Yahoo, Instagram, Netflix, Facebook, and Outlook, as well as credentials related to government institutions, banking services and streaming platforms.
According to the report efforts were made for more than a month to have the unsecured database taken down, after which it was finally taken offline.
Cybersecurity specialists said such data is extremely valuable to cybercriminals as it is used in attacks like credential stuffing where the same login details are tested across multiple platforms.
Experts further warned that evidence showing the database continued to grow suggests the malware involved may still be active raising concerns about further data leaks in the future.
Google has confirmed the incident stating that it is aware of the data leak and that the information consists of infostealer logs collected over time. Google said its automated security systems identify compromised credentials, lock affected accounts and prompt users to reset their passwords.
Security experts have advised users to immediately change their passwords, avoid using the same password across different services, enable two-factor authentication and secure their online accounts using password managers or passkeys.
Also read: Good news for Atlas Honda lovers: New 2026 model is here
