Google confirms Gmail hit by phishing scam

Following the news that 10,000 Hotmail passwords had been posted online comes confirmation from Google that its free email service Gmail has also been hit by an "industry-wide phishing scheme."

It was on Monday that Digital Journal reported on hackers having obtained the account details and passwords for 10,000 users of Microsoft's Windows Live Hotmail service, information that was subsequently posted online at pastebin.com. According to the BBC, an even larger list containing details of 20,000 accounts and passwords was been posted online again at pastebin.com. Most of the addresses are of European origin. The list is said to contain details of apparently old, fake and unused accounts, as well as information relating to genuine accounts. Google has allegedly discovered a third list but no further details of that list have been revealed. Microsoft and Google have been quick to emphasize the scam is not as a result of security issues within their organizations. On CNET, Don Reisinger reports that he received an email from Google which said:

We recently became aware of an industry-wide phishing scheme through which hackers gained user credentials for Web-based mail accounts including Gmail accounts

A Google representative went on to say the company "forced passwords resets on the affected accounts." At the present time Google is saying that fewer than 500 accounts have been affected. Yahoo has also issued a statement regarding the scam, telling The Register:

We are aware that a limited number of Yahoo! IDs have been made public. Online scams and phishing attacks are an ongoing and industry-wide issue and Yahoo! takes great effort to protect our users' security. We urge consumers to take measures to secure their accounts whenever possible, including changing their passwords. We also encourage our customers to review resources that provide guidelines on email safety.

Carole Theriault of Sophos, a security firm which recently reported that 40 percent of people use the same password for access to all of the sites they regularly visit, said much of the responsibility for the security of personal details online was indeed that of individual users. However, she said the current situation should be "a wake-up call to Google and Microsoft to educate their users." Neil O'Neil, of secure payments firm The Logic Group, spoke of how the great publicity given to the scam, which mostly likely involved hackers persuading people to divulge their personal details to fake websites that appeared genuine, could be counterproductive. O'Neil said:

Making the breach public so soon after the attack occurred has allowed unethical hackers to access the passwords very easily, even though they were deleted a couple of days ago at the request of Microsoft