Tracking down an attacker may not be possible or worth your time. You can do the basic geolocation and rwhois stuff on the IP, but more than likely it's not the

Tracking down an attacker may not be possible or worth your time. You can do the basic geolocation and rwhois stuff on the IP, but more than likely it's not the origin. The attacker probably is bouncing through TOR or another proxy solution. Also, I believe to change a password on Google you have to reauth with your current password, which never would have been transmitted in cleartext. Unless you had a MITM attack with one of those compromised certs in the wild, but you've removed your diginotar certs, right? It's more likely that your password was guessed or taken from somewhere else. I would change any other accounts which might share that password. Steps for now: turn on 2 method authentication!! Check your outbox and deleted folders for any shenanigans, although if the attacker knew what they were doing they would have deleted any trace of anything they would have done.