Google has warned that nearly 2.5 billion Gmail accounts may be exposed in a massive data theft campaign, urging users to reset passwords, review app permissions, and enable two-factor authentication.