16 Billion Passwords Leaked: What You Need To Do Now

"This isn't just a leak – it's a blueprint for mass exploitation." – Cybernews researchers

Security researchers have uncovered the largest collection of stolen credentials ever seen: approximately 16 billion unique usernames and passwords.
The trove contains fresh data allegedly harvested by multiple infostealer campaigns throughout 2025 and spans every major online platform—including Apple, Facebook, Google, GitHub and government portals.

How big is 16 billion?

Equivalent to twice the number of active internet users worldwide.
Compiled from 30 separate datasets, each ranging from tens of millions to 3.5 billion records.
Not merely recycled breaches: analysts say the vast majority is new, weapon-ready data (BleepingComputer).

Where did the data come from?

Researchers attribute the haul to infostealer malware distributed via phishing, malicious ads and cracked software.
Once installed, an infostealer quietly exfiltrates saved browser passwords, cookies and autofill data, bundling them into searchable archives that are later sold or leaked on dark-web forums.

"These credentials are ground zero for phishing attacks and account takeover." – Cybernews

Why this matters

Credential-stuffing: Attackers automate log-in attempts across multiple sites, betting on password reuse.
Business e-mail compromise: Hijacked corporate accounts enable invoice fraud and lateral network movement.
Social-engineering: Leaked e-mails + personal data fuel convincing spear-phishing campaigns.

What you should do right now

Change reused passwords—start with your primary e-mail and banking accounts.
Enable multi-factor authentication (MFA) everywhere it's offered.
Adopt a password manager to generate and store unique, random credentials.
Monitor breach alerts (Have I Been Pwned, password managers, or dark-web monitoring services).
Consider passkeys: major providers (Google, Apple, Microsoft) now support cryptographic log-ins that resist credential theft.

Expert voices

"Strong and unique passwords, plus MFA, remain the frontline defence." – Keeper Security CEO, via Forbes
"Not all leaks stem from hacking—misconfigured cloud buckets expose troves of credentials too." – Economic Times

FAQs

Is my password in this leak?

The full datasets are circulating privately, but you can check recent exposures using Have I Been Pwned or similar services. Expect rolling additions as more of the 16 billion records surface publicly.

Is this a single breach?

No. It's a collection of many breaches plus infostealer dumps aggregated over months. Think of it as a mega-index for attackers.

Are passkeys immune?

Passkeys rely on public-key cryptography and never transmit your secret. Even if a site is compromised, attackers cannot reuse a passkey elsewhere—making them a strong defence against credential leaks.