I received the following message from Gmail indicating someone attempted to hijack my account. I confirmed this by looking at the details history on my account and the IP address listed below showed up. What could this be? I didn't know many attacks were originating from Mexico.

Hi *,

Someone recently used your password to try to sign in to your Google Account *@gmail.com. This person was using an application such as an email client or mobile device.

We prevented the sign-in attempt in case this was a hijacker trying to access your account.

Please review the details of the sign-in attempt: Thursday, February 6, 2014 12:52:06 AM UTC IP Address: Location: León, Guanajuato, Mexico

If you do not recognize this sign-in attempt, someone else might be trying to access your account. You should sign in to your account and reset your password immediately.

Reset password

If this was you, and you are having trouble accessing your account, complete the troubleshooting steps listed at http://support.google.com/mail?p=client_login

Sincerely, The Google Accounts team

  • 1
    Do you have any reason to believe it's not exactly what they say it is? What, exactly, are you asking here?
    – ale
    Feb 6 '14 at 2:29
  • I just want to know the likelihood of this being a large scale attack on multiple gmail accounts or was mine singled out?
    – user59848
    Feb 6 '14 at 2:56
  • 2
    Unless there's a news item about it, how are we supposed to know? Online accounts are attacked every day, all day. Heck, it could just be someone who mistyped their user account name. Have you followed the advice given (i.e., reset your password)? I would strongly consider using two-step authentication. But, honestly, the only people who could answer your question are the Google people who monitor attacks.
    – ale
    Feb 6 '14 at 3:39
  • Yes I reset the password and checked the IP online and there is no known suspicious activity as of yet being reported anywhere on the internet. I have seen some other examples with similar situations from other mexican IP addresses so I guess that is a little reassuring and not at the same time.
    – user59848
    Feb 6 '14 at 3:47

It's an obvious phishing attempt. If someone "recently used your password" they would have gained access to your gmail account. It doesn't say they tried to login it says they "used your password". I would hope Google would not use such incorrect symantics. I am betting the imbedded hyperlink in the email is not a legit Google link.

  • You'd hope. Gmail even widely uses the word "email" incorrectly - to mena email address, not message.
    – ChrisJJ
    Jan 21 '20 at 20:48

Hackers are everywhere, so I would just change your password and move on. I would also keep the IP address so that in case this sort of thing ever happens again, you can check and see if the second time it is the same IP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.