“Cybernews researchers have uncovered a massive compilation of ~16 billion leaked login credentials—spanning Google, Facebook, Apple and more. Originating from multiple breaches & infostealer malware, this data dump gives cybercriminals unprecedented access. Experts urge strong passwords, unique logins, MFA, and passkeys to protect yourself.”
How it happened
Cybernews researchers discovered 30 datasets, containing an estimated 16 billion login credentials—more than double the world’s population. These credentials, sourced from multiple security breaches and aggregated in a short-lived exposure, include logins from major services like Google, Facebook, Apple, Telegram, GitHub, and government portals.
No single company was hacked; instead, data was harvested over time and combined in a massive compilation.
Why it matters
- Credential stuffing: Attackers use these dumps to automate logins on other services—leveraging password reuse. They exploit victims when the same credentials work across sites.
- High risk: With credentials for major platforms, cybercriminals can access email, social media, financial services, and even personal accounts. Stolen tokens/cookies may bypass authentication altogether.
Who’s behind it?
Infostealer malware—programs installed surreptitiously to harvest saved passwords and cookies—is believed to be the main culprit. The aggregated dataset then appeared briefly online before being spotted by Cybernews.
What you can do
- Strong, unique passwords: Avoid reuse. Consider password managers or passkeys.
- Enable MFA: Adds an essential layer of security, preventing easy account takeover.
- Check exposures: Use services like Have I Been Pwned or browser/manager breach-monitoring tools.
- Monitor accounts/credit: Watch for unusual activity and use dark‑web monitoring services or credit report checks.
- Adopt passwordless options: Google, Apple, Microsoft, Meta and others are moving users to passkeys—more secure than traditional passwords.
