A password warning does not automatically mean that the email provider itself was breached. A website or app may have exposed a reused password, and security tools can compare saved credentials with known public disclosures. Google explains that Password Checkup can flag passwords that are exposed, weak, or reused. Treat a warning seriously, but open the checkup directly rather than following an unsolicited email link.
Check the warning safely
Go to your browser’s password manager or type passwords.google.com yourself, then open Password Checkup and sign in if asked. Review which saved entries are affected. Do not paste your password into a third-party “leak checker,” and never share a one-time verification code with someone who contacts you.
Change exposed or reused passwords
Visit the affected service by typing its address or using its official app. Change the exposed password to a long, unique one that you do not use elsewhere. If you reused it on other websites, change those accounts too, starting with email, banking, cloud storage, and social accounts. A password manager can create and store separate passwords. Do not make a small variation of the old password; attackers often try predictable variations.
Secure the account around the password
Review recent sign-ins, recovery email and phone numbers, forwarding rules, and connected apps. Remove unfamiliar sessions or integrations after confirming they are not yours. Turn on multi-factor authentication and save recovery codes somewhere private. If you cannot sign in because someone changed your details, use the provider’s official account recovery process.
Watch for follow-up scams
Attackers may use a breach notification as a pretext to send fake support messages or extortion. Do not click links in unexpected warnings. Open the service directly and check its security center. A real password manager alert should not ask you to send your current password to support.
The historic article associated with this page described a 2014 “five million Gmail” list. Without a reliable primary source confirming that headline, this guide does not assert that Gmail systems were breached. Google’s current help explains how to check exposed credentials and what to change. Password Checkup can identify known risks, but it cannot guarantee that every compromised password is detected.
