It is true that some Russian hackers posted a list of about 5 million Gmail addresses and passwords online! The person who posted the file claimed that nearly 60 percent leaked passwords were valid and working.
You can use Russian site called Is Leaked to verify whether your Gmail addresses are on the list. If listed, make sure to reset your password right away.
Google says “It’s important to note that in this case and in others, the leaked usernames and passwords were not the result of a breach of Google systems,” Google said in its blog post. “Often, these credentials are obtained through a combination of other sources. For instance, if you reuse the same username and password across websites, and one of those websites gets hacked, your credentials could be used to log into the others. Or attackers can use malware or phishing schemes to capture login credentials.”
You can activate Google two-step verification to avoid such issues and to add an extra layer of security.