Google Security Alerts: Blocked Sign-In and Leaked Password Guide

Quick Answer

If Google reports “Sign-in attempt was blocked”, open your Google Account directly and review the event. If you do not recognize the attempt, change the affected account’s password immediately and check its devices, recovery settings, and connected applications. A blocked attempt does not establish whether any earlier unauthorized access occurred.

A verified Google Workspace “Leaked password” alert means Google detected compromised credentials and requires a password reset before the user can sign in again. Administrators should investigate the affected account and complete the reset rather than assume the notification means recovery is already finished.

What the Alerts Mean

Alert or message	Meaning	Recommended response
Sign-in attempt was blocked	Google prevented the reported attempt. If the verified event says someone used your password and it was not you, treat the password as compromised.	Review the event, change the password, and investigate existing access.
Leaked password	Google Workspace detected compromised credentials and imposed a password-reset requirement.	Have the administrator review the alert and secure the affected user account.
Copy sent to a recovery email	The recipient address is associated with recovery for the account named in the alert.	Identify the affected account before changing any settings.

Possible causes of password exposure include phishing, malicious software, and password reuse on another breached service. These alerts alone do not establish where a password was stolen or prove that Google suffered a breach.

1. Verify the Alert and Identify the Correct Account

1. Open a new browser tab and manually enter myaccount.google.com. Avoid signing in through an unexpected email’s button.
2. Check the account address shown in your profile. Select the account named in the warning.
3. Open Security & sign-in and review recent security events.
4. Compare the event’s device, time, and location with your activity. Follow the option indicating the activity was not yours when appropriate.
5. For a managed work or school account, notify your IT administrator through your usual support channel.

A familiar sender name, Google logo, or displayed sender address is not sufficient proof that an email is genuine. Verify the event inside the account. If you cannot find it, recheck the affected address and ask your administrator to investigate before using the email’s links.

Only confirm an event as yours when its details match activity you recognize. Google provides separate responses for recognized and unrecognized activity.

If the Message Was Sent to Your Recovery Address

The account receiving the copy is not necessarily the affected account. Read the account address inside the warning. Receiving a recovery notification does not, by itself, establish that your recovery mailbox was accessed.

If the named account is unfamiliar, do not attempt to sign in to it. Verify the notification before following any recovery-address removal instruction, and ask your IT team for help if it involves a company address.

2. Change the Affected Account’s Password

Use a trusted device. If you suspect malware on your usual computer, use another trusted device for the password change and have the suspect computer checked.

1. Open your Google Account directly.
2. Select Security & sign-in.
3. Under How you sign in to Google, select Password.
4. Complete identity verification if prompted.
5. Set a new, unique password and select Change Password.

Google documents exceptions to automatic sign-out after a password change, including some verification devices and devices with third-party access. Continue with the access checks below.

3. Review Devices and Existing Access

Sign Out Unrecognized Sessions

1. In Security & sign-in, find Your devices.
2. Select Manage all devices.
3. Open unfamiliar devices or sessions and inspect their details.
4. Select Sign out for access you cannot account for.

Multiple sessions can belong to one device. Displayed times can include background synchronization, and locations may be approximate. Assess the details together. If an unfamiliar device name has several sessions, review and sign out each relevant session. 

Check Account and Gmail Settings

• Confirm that recovery email addresses and phone numbers belong to you.
• Review registered sign-in and verification methods for unfamiliar additions.
• Remove unrecognized third-party application access.
• In Gmail, inspect forwarding, filters, delegated mailbox access, and outgoing-mail settings.
• Check for messages you did not send and unexpected changes to files or sharing.

Record suspicious settings privately before removing them if your IT team needs evidence. A password change does not undo unauthorized forwarding rules or other account configuration changes. Google’s compromised-account checklist includes reviewing these settings and removing harmful software. 

4. Google Workspace Administrator Procedure

These steps require an administrator account with the relevant privileges. Available investigation controls depend on your role and Workspace edition.

Review the Alert

1. Open admin.google.com directly.
2. Go to Security > Alert center.
3. Open the relevant alert and confirm the affected user and event time.
4. Record the details in your incident record and confirm the user’s activity through a trusted channel.

Contain Suspected Compromise

Google’s administrator checklist recommends temporarily suspending a suspected compromised account during investigation. Suspension resets sign-in cookies and OAuth tokens, which are credentials applications use for authorized access. Restore access only after completing containment and recovery checks.

Investigate successful and unsuccessful sign-ins, relevant email activity, application authorization, and file-sharing changes. If the affected user is an administrator, examine administrative changes as well. Preserve relevant evidence and revoke unauthorized application access. 

Reset the Password and Sign-In Cookies

1. Go to Directory > Users and locate the affected user.
2. Select Reset password and generate a new password.
3. Require the user to change it at the next sign-in.
4. Deliver temporary credentials through an approved, independently verified channel.
5. Open the user’s account page, then select Security > Sign in cookies > Reset.

If your organization uses single sign-on through another identity provider, follow the applicable identity-provider recovery process as well. Google directs administrators using third-party single sign-on to separate password-reset guidance. 

5. Reduce the Risk of Another Incident

• Replace the exposed password anywhere else it was reused, using a different password for every account.
• Enable 2-Step Verification, which adds another verification step to password-based sign-in.
• Use security keys or passkeys where supported by your account and organization.
• Keep recovery methods current and protect the recovery mailbox.
• Update your operating system, browser, and applications.
• Review unnecessary browser extensions and scan suspected devices with trusted security software.

A reputable password manager can help generate and store unique passwords. Complete Google’s Security Checkup and address its recommendations. 

How to Verify Recovery

Check	Expected result
Sign-in	The legitimate user can sign in with the new credentials and required verification.
Devices and sessions	Unrecognized sessions have been signed out; remaining access is accounted for.
Recovery and application access	Only approved recovery methods, sign-in methods, and applications remain.
Mailbox settings	No unauthorized forwarding, delegation, or filters remain.
Workspace investigation	The administrator has reviewed relevant activity and documented containment and recovery.

Continue monitoring for new events. Completing these checks does not prove that no information was accessed before containment.

If Access Cannot Be Restored or Alerts Continue

For a personal account, use Google Account recovery. For a managed account, contact your Workspace administrator. Do not share passwords, backup codes, or verification codes with anyone offering account-recovery assistance.

If another warning arrives, compare its event time with the password-change time and confirm the affected account. An email received later is not sufficient evidence that a new compromise occurred. Investigate genuinely new suspicious activity, including device infection, unauthorized application access, and changes to recovery methods.

Reconnect legitimate applications individually after recovery. An administrator should restore a suspended account only when it is safe to do so. Do not reinstate suspicious access or weaken authentication simply to make an application work.

Frequently Asked Questions

Can these alerts appear when 2-Step Verification is enabled?

Yes. Additional verification can help prevent access even when a password is exposed. An unfamiliar password-use event still warrants a password change and investigation.

Does the alert reveal which website leaked my password?

Not necessarily. The alert does not, by itself, identify the original source of exposure. Avoid attributing the incident to a specific service without evidence.

Should I reset or reinstall my computer immediately?

These alerts alone do not justify reinstalling an operating system. Secure the account first and investigate suspected devices. Let confirmed findings determine whether more extensive remediation is necessary.

Should I delete the alert after changing the password?

Keep relevant details until your investigation is complete. Deleting a notification does not revoke access or repair account settings.

What if the affected mailbox handles invoices or payments?

Escalate the incident promptly to your IT team. Review unexpected payment instructions and verify changes through a previously established contact method before acting on them.

Sources

• Google Account Help — Respond to security alerts
• Google Workspace Help — View alert details
• Google Account Help — Change or reset your password
• Google Account Help — See devices with account access
• Google Account Help — Secure a hacked or compromised Google Account
• Google Workspace Help — Identify and secure compromised accounts
• Google Workspace Help — Reset a user’s password
• Google Account Help — Make your account more secure