The World’s Largest Data Breach: 16 Billion Passwords Leaked

On June 18, 2025, the digital world was rocked by an unprecedented breach: over 16 billion login credentials were leaked online, drawn from at least 30 separate datasets. Cybersecurity researchers have confirmed this as the largest credential dump ever recorded.

While rumours flew that major players like Apple, Facebook, and Google were hacked, Cybernews, the news outlet that looks into cybersecurity research, testing and data, quickly clarified there is no indication that this is true. As Cybernews expert Bob Diachenko noted, this “opens the doors to pretty much any online service imaginable,” not because the infrastructure was compromised, but because stolen credentials were tied to major platforms.

Infostealer malware infiltrates devices—typically through phishing, malicious downloads, or pirated apps—and quietly harvests sensitive data, including stored passwords, session cookies, and tokens. This leak includes a large number of social media login credentials, VPNs, and other user accounts.

This latest leak included everything from social media logins to VPN credentials and other sensitive account information. It doesn’t just affect a handful of people—millions around the world, especially in Asia, Africa, and Latin America, are at risk due to rapid digital growth alongside weaker cybersecurity infrastructure.

However, there exist other perspectives. Hudson Rock, an Israeli cybersecurity company, said that its data showed approximately 50 credentials stolen for every computer. So, for it to add up to 16 billion, around 320 million devices would be needed. This number is highly unrealistic. The company also mentioned that the leak is not very dangerous, as a majority of the data leaked could be AI-generated or recycled.

To counter the risks, experts across the security community advise taking immediate steps:

1. Change passwords for any account you have reused elsewhere.
2. Enable two-factor or multi-factor authentication or adopt passkeys.
3. Use a trusted password manager to generate unique, strong passwords per account.
4. Make sure to consistently monitor your accounts for unusual logins and enable security notifications.

The credential leak serves as a stark reminder of the growing threat posed by infostealers and the importance of cybersecurity and digital hygiene. The sheer magnitude of the exposure necessitated prompt action from both users and institutions, even though the compromised credentials were not the result of a single breach. Now more than ever, it’s crucial to use strong passwords and watch out for signs of suspicious activity, like unfamiliar login attempts or account changes you didn’t make.