Originally Posted by Taf

I contacted google directly and asked if the email warning was genuine.

"Yes, we detected a leak of emails and passwords from a few servers not related to google. It is highly recommended that you visit each site in the report and change your password".

I was given a hint at to what the account password was, and from that I realised it was made by our son. Obvious from his choice or words. Luckily he had it written down from 4 years ago!!

So I checked the list of compromised passwords, and they are mostly on sites I haven't been on for at least a couple of years. None of them would have any financial or personal details on them, but I'll plod through the list of 13 and change passwords IF I can remember what the present ones are!

So mystery solved, but I still wonder how google got all the info?