Gmail account “hacked”

Question

Someone from China recently gained access to my gmail account. When I see the logs, it does show a Chinese IP address.

The account activity logs show

Browser     * India (KA) (14.96.25.209)     18:20 (0 minutes ago)
Browser     India (KA) (14.96.25.209)   18:07 (12 minutes ago)
Browser     India (KA) (14.96.25.209)   17:47 (33 minutes ago)
Browser     China (58.48.146.157)   17:44 (36 minutes ago)
Browser     India (KA) (14.96.25.209)   17:11 (1 hour ago)
Browser     India (KA) (14.96.25.209)   16:53 (1 hour ago)
Browser     India (TN) (14.96.116.139)  13:40 (4 hours ago)
Browser     India (TN) (14.96.116.139)  13:07 (5 hours ago)
Browser     India (TN) (14.96.116.139)  12:40 (5 hours ago)
Browser     India (TN) (14.96.116.139)  12:16 (6 hours ago) 

Now, while I did manage to change my password within a minute or so after the chinese guy got in, I have no idea how it happened. Also, gmail did not give me any notification of unusual account activity.

My laptop has a fresh,updated install of windows 7, with MSE installed, so its unlikely my password was taken from there, and I will be uninstalling a 3rd party app I was using on my cell to access Gmail.

What I want to ask is:

1) Are there any scans,etc. that I should run on my computer to secure it?

2) Why would gmail not show chinese activity on a gmail account never accessed outside India as suspicious activity?

Answer 1

If you used the same e-mail password as for another site, it is possible that that site was compromised, and they obtained your password that way. But it's still worth running a full virus scan on your computer anyway. Most virus scanners can detect keyloggers these days (the most likely form of attack).

Answer 2

1. I would recommend running an anti-virus program to ensure your computer is safe. Also, change your password. Try to make it long and have it vary in case, and include numbers and/or symbols. Thinking of a phrase can help with this.

2. There are many reasons this could have happened. A weak password. A strong password that was also used on a site that was hacked or not secure could expose your information.

The most benign possibility would be that you accessed your account using a device that happened to route itself as if though it originated from China. For example, I live in the U.S., yet facebook sees my cell phone as originating in Brazil!

Answer 3

Another possible reason for showing for such kind of messages is, if you set up mail forwarding to another account, it will show like that, always It does not mean your account got hacked. Just ensure that you have not configured your mail account with any other portal to access. If not, then think that your account got hacked, if it is so, just change your password, for more security change your secret question and finally you can choose tow step verification from google.

Why I am telling you is, actually I got such kind of messages, but later I came to know that It is because I configured my gmail account in another portal called mail.com, along with the mail id I have in that portal. whenever a import process done, immediately in the gmail notifications, I have seen that my account has been accessed from US.

So its a chance, please check.