Cybercrime watchdog the Federal Office for Information Security said it had discovered the mass theft of email addresses and passwords as part of an ongoing wider investigation.
Law enforcement officers and researchers had found the list in so-called botnets, networks of hijacked computers whose users usually don't know their hard drives are infected.
About half of the affected accounts had email addresses with Germany's domain-name ending .De.
The office set up a German-language website to allow Internet users to check whether their accounts are affected, but the service initially collapsed under a high number of requests.