Concerted attack on linked google accounts?

Question

Yesterday I received two (authentic) e-mails from Google saying they prevented sign-in attempts to two (very old) google accounts of mine. Google says they used the correct passwords, which turned out to be very old passwords that I had not changed, simply because I have not used these accounts in a very long time (more than 5 years).

This is the first thing that struck me as very odd. I had basically never used even used these accounts for anything. As far as I can remember, I may have signed up with them for an Apple ID, but let's move on.

The thing they did have in common for certain was the recovery e-mail.

Now, I wasn't going to ask a question about this here at first, because it's probably nothing that can be answered here.

However, today I was told by a relative that one of her (old and pretty much unused) Google accounts was also attacked with the correct password (around the same time yesterday). This account was likely setup by me for her and may be linked in one way or another to some of my Google accounts (either through exchange of communication or recovery email).

1. Neither of these accounts or passwords(!) is present on http://haveibeenpwned.com

2. Neither of these accounts has been used in a while and was never used much at all

3. All of these accounts appear linked

I am not asking you to speculate about what happened here in particular, but is there a reasonable explanation of how those accounts may have been compromised?

My most likely explanation would be that another (linked) account got compromised and these e-mail addressed where extracted from there?

Or should I consider my personal computers to be compromised as this sort of information could technically have been extracted from there?

I am usually a reasonable cautious person, using a password manager, etc. and I already changed all the passwords to these accounts, but is it also considered good practise in this case to rebuild my personal machines?

I am looking for advice here, because I can't wrap my head around how those specific (old and very rarely used) credentials could have gotten leaked.

Answer 1

A few things to note: the account and password lookup features on HaveIBeenPwned only represent found from public database leaks that have been cracked or were in plaintext. It's still possible that your account was still breached but the breach never publicly surfaced. Most websites don't delete inactive accounts, so a recent leak could have been responsible for your old accounts being compromised.

If I had to speculate, assuming it wasn't someone targeting you specifically, your account was probably part of a database leak. They took the credentials from the leak and began credential stuffing, eventually logging into your email account.

My most likely explanation would be that another (linked) account got compromised and these e-mail addressed where extracted from there?

Or should I consider my personal computers to be compromised as this sort of information could technically have been extracted from there?

I find these two scenarios less likely for a few key reasons:

1. If a linked account was compromised, they wouldn't immediately have access to your other account's password unless you had it saved somewhere.
2. If a linked account was compromised, you likely would have seen a login alert for that account as well.
3. Assuming your password wasn't saved in the linked account, they would likely need to use the "password recovery" feature to reset the password and gain access. It sounds like you still have access to the account, so that doesn't seem to be the case.
4. If your personal computer was compromised, it wouldn't have been your 5-year old unused email accounts being breached.

... is it also considered good practice in this case to rebuild my personal machines?

If you want to rebuild your machines, that's up to you. However, if you are going to factory reset your machines, make sure you do that first. If your devices are compromised, changing your passwords before doing a reset won't fix the issue.
It may not seem related, but keeping regular backups makes factory resets easier to recover from, meaning less downtime from having an account breached.

Another thing you may want to consider is that all emails in your breached accounts may have been read. Years ago, it wasn't uncommon for websites to send you your account passwords in plaintext when you signed up. You may want to search for "password", "welcome", or "login" in your old emails to see what other accounts may have been compromised.