World’s largest password leak exposes 16 billion credentials

A record-shattering password leak has surfaced, exposing over 16 billion login credentials in what cybersecurity researchers are calling the largest data breach in internet history.

First reported by Cybernews and Forbes, the breach is being treated as a major cybersecurity emergency with global implications.

Investigators say the leak consists of highly structured, newly harvested credentials, not just recycled data from older hacks. The credentials — collected primarily through infostealer malware — are now circulating on dark web marketplaces, opening the door for widespread phishing attacks, identity theft, and account takeovers.

The breach stems from at least 30 separate exposed datasets, each containing tens of millions to over 3.5 billion records, according to Vilius Petkauskas of Cybernews. These datasets were mostly compiled using advanced infostealer malware, which silently captures usernames and passwords from infected devices.

Rather than vague or outdated data dumps, this breach features fresh, weaponisable data. The information is neatly organised, typically showing the URL, followed by login credentials and passwords — making it easy for attackers to exploit online services like Apple, Google, Facebook, Telegram, GitHub, and even government platforms.

In response to the breach, Google has urged billions of users to switch from traditional passwords to more secure passkeys. The FBI has issued warnings about suspicious SMS links, which could be part of widespread phishing campaigns tied to the stolen data.

Security experts emphasise the scale of the danger: virtually anyone with minimal resources can now purchase stolen credentials online. As per a report by Merca20, the leak lowers the barrier to cybercrime, making it possible for low-level actors to gain unauthorized access to sensitive systems.

Cybersecurity professionals warn this isn’t just another leak — it’s a blueprint for mass exploitation. Unlike past breaches that exposed specific companies or platforms, this trove gives cybercriminals the tools to penetrate nearly every layer of online infrastructure.

"One compromised password can be the gateway to a user’s entire digital life," experts said. The combination of scale, structure, and freshness of the data makes this breach particularly dangerous.

If you suspect your credentials may be part of the breach, take immediate action:

The stolen credentials appear to originate from a mix of credential stuffing lists, repackaged previous breaches, and new infostealer logs. In many cases, infostealers secretly upload stolen data to hacker-controlled servers — or accidentally leave them unsecured, eventually making their way to the public.

With over 16 billion active credentials now exposed, the threat is immediate and widespread. Security experts stress that every internet user, regardless of location or profession, should act now to shore up their defenses before the next wave of attacks hits.