Gmail Account Password Compromised Twice In Two Weeks

Question

I have an many Gmail accounts and I've never had any issues like this. I created a new Gmail account for a new website I created. It has the same name as the website, e.g. something.com and something@gmail.com

Its password has been compromised twice in the last two weeks. The first time it was compromised, I changed the password to something that is over 40 characters long and contained every type of character in it. Yesterday evening, it was compromised, too. The problem is if the most powerful supercomputer were to make an brute force attack, it would take forever for it to guess it right, assuming Google doesn't stop it from making trillions of guesses every second.

What's even more confusing is that I created the account a month ago. It receives no mails whatsoever, and no human or machine knows the address of this mail because I never used it for anything. It just exists there. There are two machines that were logged in to it: my desktop and smart phone. My desktop does not seem to be compromised in any way. My smart phone is outdated, and does not receive any more OS updates because the hardware is not capable of running the newer versions. I am also logged in to all my other mail account on this phone, but I did not have any problems with the others security-wise. I also did not enter my password anywhere except when I was alone in my room, so it is not possible for anyone to see me entering that password. I only entered it once, when I changed my password two weeks ago anyways.

The login attempt seems to be made from US according to Google, but the IP address' origin seems to be Brussels, Belgium and it also looks like the IP belongs to Google. The following are two IPs that Google informs me of:

• 2a00:1450:400c:c0c::214
• 2a00:1450:400c:c0c::21f

My question is that how in the world they knew what my password was? Could these be fake warnings from Google, just to get me to change my password?

Answer 1

The problem appears to be related to redirecting my mails to another e-mail of mine. Because I have many e-mails, instead of trying to check all of them, I redirected all of them to my main e-mail account through POP3. Gmail sees POP3 unsafe, even though it is the only way to do it. This also explains why IPs belong to Google.

There is still the question why it happens once in two weeks while mails are being checked many times a day, but it makes more sense than someone figuring out the password.

Answer 2

I doubt you are getting fake messages from Google. It's more likey that you are getting spoofed messages from a source claiming to be Google. Another possibility is that a Google user in Belgium has a hacked account that's being used to bounce unauthorized emails. There's also a concern about the old phone you're using. If it's no longer supported then it's sure to be a hackers dream. If this is such a fresh account then you can check the sent messages to see if hackers are actively using it. But if all you have is a couple of emails claiming that your account is compromised then it's likely just a scam. I would definitely contact Google though. Never click on a link inside an email. Always go directly to a website to login.