Nearly 5 million login details of Gmail accounts have been leaked on a Russian Bitcoin forum. The user who is supposed to have dumped the information on Bitcoin Security board goes by the alias of “tvskit”, and says that while not all entries are valid, more than 60% of them should be working, with the passwords provided in plain text.

The total number of entries in the database is 4,929,090. Apparently, most of the accounts belong to English, Spanish, and Russian speaking nations. Anyone affected by this leak are advised to immediately change their password.

The list has since been taken down, leaving no trace that Gmail itself was hacked. Most sources claim that some many of the information are quite old. This could mean that they were leaked long ago, though others are claiming 60% of the passwords are still valid.

It is not clear, however, on how the information has been gathered, but the most probable theory is that the attacker(s) collected the details through phishing and different forms of data exfiltration, such as the use of info-stealing malware.

In order for the users to see if their Gmail account was one of the leaked, they can utilize a web-based tool, isleaked.com, which also checks for recent Yandex and Mail.ru leaks. If the user doesn’t feel comfortable giving their email address to any untrusted tool, they could always change their existing passwords.

There is no specific details on how these passwords were leaked or when the passwords were leaked from other web sites over the years that were associated with Gmail addresses. As of this moment, many people used the same password for multiple accounts, which is why some may find that their old Gmail password was leaked (while others are seeing passwords not from Gmail).

More details should be available on this matter. But then again, it is best to keep personal email accounts safe and updated at all times.