Data Breach

[Valley_]

Hello all,

 

I've just received an email from Google saying that my Google password has been found in a non-Google data breach.

 

I did not click anything on the email fearing it was phishing of some sorts. I went to my Google account via the Google app and sure enough it says the same thing there so the email was genuine.

 

My concern is that my Google password has NEVER been used anywhere else. That password was never once reused, so how can it be possible that it was leaked from a non-Google source?

 

I do store my passwords using NordPass, so I'm figuring either Google is lying, or NordPass is the culprit. 

 

Alternatively, one would have to assume that one of my devices itself has been compromised. 

 

Any advice would be greatly appreciated here, as I'm a bit lost on how this could've happened.

 

Thanks in advance.

 

*Sorry if this is the wrong thread, I couldn't find one for security*

[Agall]

25 minutes ago, Valley_ said:

Hello all,

 

I've just received an email from Google saying that my Google password has been found in a non-Google data breach.

 

I did not click anything on the email fearing it was phishing of some sorts. I went to my Google account via the Google app and sure enough it says the same thing there so the email was genuine.

 

My concern is that my Google password has NEVER been used anywhere else. That password was never once reused, so how can it be possible that it was leaked from a non-Google source?

 

I do store my passwords using NordPass, so I'm figuring either Google is lying, or NordPass is the culprit. 

 

Alternatively, one would have to assume that one of my devices itself has been compromised. 

 

Any advice would be greatly appreciated here, as I'm a bit lost on how this could've happened.

 

Thanks in advance.

 

*Sorry if this is the wrong thread, I couldn't find one for security*

What domain was the email from?

[Valley_]

1 minute ago, Agall said:

What domain was the email from?

accounts.Google.com

 

 

But like I said, I did go onto my security page on my Google account (not via the email) and it had the same warning there

[Agall]

1 minute ago, Valley_ said:

accounts.Google.com

 

 

But like I said, I did go onto my security page on my Google account (not via the email) and it had the same warning there

I know Chrome will do some level of check for account credentials stored in the browser and synced to the google account. I've had some really old ones I forgot about get flagged as breached, accounts I no longer use but Google doesn't know that.