In one of the largest data breaches in history, cybersecurity researchers have confirmed the leak of 16 billion login credentials, including passwords. The information leak can open the door to "pretty much any online service imaginable, from Apple, Facebook, and Google, to GitHub, Telegram, and various government services", according to a report in Forbes.
• 16 Billion Credentials Leaked
Cybernews researchers uncovered 30 freshly exposed datasets—with sizes ranging from tens of millions to up to 3.5 billion records each—totaling about 16 billion unique login/password pairs (news.com.au).
Leaked data includes credentials for leading platforms such as Apple, Facebook, Google, GitHub, Telegram, along with VPN services, corporate networks, and even government accounts (news.com.au).
Researchers warn this isn’t recycled data—it’s new, structured, weaponizable intelligence ready to be used in phishing, credential stuffing, account takeovers, and business email compromise (BEC) (news.com.au).
Security agencies (Google, FBI) and experts advise that everyone should:
The data stems from infostealer malware that plundered credentials from infected devices, then stored them on unsecured databases (e.g., open Elasticsearch servers) before they were briefly discovered by researchers (news.com.au).
Cybernews researchers uncovered 30 freshly exposed datasets—with sizes ranging from tens of millions to up to 3.5 billion records each—totaling about 16 billion unique login/password pairs (news.com.au).
• Wide Platform Impact
Leaked data includes credentials for leading platforms such as Apple, Facebook, Google, GitHub, Telegram, along with VPN services, corporate networks, and even government accounts (news.com.au).
• “Blueprint for Mass Exploitation”
Researchers warn this isn’t recycled data—it’s new, structured, weaponizable intelligence ready to be used in phishing, credential stuffing, account takeovers, and business email compromise (BEC) (news.com.au).
• Expert Recommendations
Security agencies (Google, FBI) and experts advise that everyone should:
- Change passwords immediately
- Stop reusing passwords across sites
- Enable multi-factor authentication (MFA) or passkeys
- Use a password manager
- Watch for phishing and suspicious activity (news.com.au, m.economictimes.com)
• What Happened?
The data stems from infostealer malware that plundered credentials from infected devices, then stored them on unsecured databases (e.g., open Elasticsearch servers) before they were briefly discovered by researchers (news.com.au).
• Why It Matters
- This is the largest known credential breach in history "?"
- Exposes nearly two accounts for every person on Earth
- Could lead to a wave of phishing, fraud, identity theft, and crypto theft (tomshardware.com)
Take Action Now!
- Change passwords immediately, especially for sensitive accounts
- Use unique, strong passwords stored in a trusted manager
- Turn on MFA/passkeys where supported
- Stay alert for phishing and review your login activity

