0

I have been using my personal Gmail Account for years to create accounts on a wide range of websites like evite.com and Instagram.

Google conducted a dark web scan and created a report of instances where my personally identifiable information (PII) was leaked on the dark web, and this report was very alarming.

My email address was found on the dark web along with my PII on websites where I do remember creating accounts on and websites where I did not create accounts on.

Among the most alarming websites where my PII was found:

  1. Russian Bitcoin Security Forum Account Dump
  2. 2019 Antipublic Combo List

I never interacted on item (1) above.

Google offers a dark web alert service in their Google One product where I get notified upon future instances of my PII getting leaked on the dark web. I have enabled this alert.

My email, name, gender, old address, old phone number, and old passwords were found on the dark web.

I have many business contacts I keep in touch with on said Gmail Account and ample reasons to keep using my account.

I have enabled 2 factor authentication, I change my password to a strong passphrase periodically, and enabled all recommended security and recovery features that Gmail offers for Gmail accounts.

I now refrain from creating new accounts on websites with said Gmail address, and have deleted as many accounts created with said Gmail address on the dark web report mentioned in the 2nd paragraph above.

All things considered, what are your thoughts about me continuing to use said Gmail account?

2
  • There is nothing in what you've said that suggests that the Gmail account was compromised.
    – schroeder
    Commented Nov 22, 2023 at 23:05
  • Remember that your Gmail address is not really yours. It's just a handle that the service grants to you. Some breaches are made up or just a mix data from various sources, especially if your email address is like [email protected]. You should not be too worried if you have access and a recently changed password NOW.
    – Marcel
    Commented Nov 23, 2023 at 11:18

1 Answer 1

1

As already mentioned in a previous response, from what you have explained, there is nothing to suggest that your account is currently compromised. It sounds like you adopt good security practices when it comes to your account security, so personally, I wouldn't worry about it too much.

The two sites that you're most alarmed about your PII being found are basically just huge data dumps of account information that have been collected from various breaches across different sites.

For reference, the 2019 Antipublic Combo List contains 1,409,578,442 aggregated records.

The Russian Bitcoin Security Forum Account Dump is just stating that your information has been found in a data dump file that was posted on this forum, not that an account has been made with your details.

Neither of these would be cause for alarm unless they were so recent that you hadn't updated your passwords and you were not using extra security steps such as 2FA.

Some other reasons why your email may appear on breaches for sites that you've never interacted with could be:

  • The breached site scraped this data on you from public sources for marketing reasons
  • Someone with a very similar email address made a typo whilst setting up an account and accidentally matched yours
  • The source/site in question is a parent/partner or in some way works with a site that you did set up an account on and therefore stores some of your data for various functions.

Ultimately, it's unfortunately very normal to find that your information has been included in some historical breaches, Google notifies you of this so you can double check that you've updated your passwords and enabled extra security steps like 2FA on the accounts mentioned in these data dumps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .