Skip to main content ↑ ↓
Topic: 16 BILLION passwords are stolen from just about every financial and government i (Read 724 times) previous topic - next topic
0 Members and 1 Guest are viewing this topic.

16 BILLION passwords are stolen from just about every financial and government i

https://www.forbes.com/sites/daveywinder/2025/06/20/16-billion-apple-facebook-google-passwords-leaked---change-yours-now/

Update, June 22, 2025: This story, originally published on June 18, has been updated to include details of how to switch from passwords to the much more secure passkey technology if you are an Apple, Facebook or Google user. There is now also additional input from cybersecurity professionals regarding the 16 billion credentials mother of all leaks, including clarification regarding the legitimacy of the data leaked and the services impacted. This is a constantly evolving story, and I will do my best to keep the coverage here up to date.

If you thought that my May 23 report, confirming the leak of login data totaling an astonishing 184 million compromised credentials, was frightening, I hope you are sitting down now. Researchers have just confirmed what could be the largest leak ever, with an almost incredulous 16 billion login credentials, including passwords, exposed. As part of an ongoing investigation that started at the beginning of the year, the researchers have postulated that the massive password leak is the work of multiple infostealers. Here’s what you need to know and do.
ForbesReplace Your Gmail Password Now, Google Tells 2 Billion Users
By Davey Winder
Is This The Biggest Yet When It Comes To Passwords Leaking?

Password compromise is no joke; it leads to account compromise and that leads to, well, the compromise of most everything you hold dear in this technological-centric world we live in. It’s why Google is telling billions of users to replace their passwords with much more secure passkeys. It’s why the FBI is warning people not to click on links in SMS messages. It’s why stolen passwords are up for sale, in their millions, on the dark web to anyone with the very little amount of cash required to purchase them. And it’s why this latest revelation is, frankly, so darn concerning for everyone.

According to Vilius Petkauskas at Cybernews, who says researchers have been investigating the leakage since the start of the year, “30 exposed datasets containing from tens of millions to over 3.5 billion records each,” have been discovered. In total, Petkauskas has confirmed, the number of compromised records has now hit 16 billion. Let that sink in for a bit. These collections of login credentials, these databases stuffed full of compromised passwords, comprise what is thought to be the largest such leak in history.
MORE FOR YOU

“Intelligence agencies and threat actors alike use these and accumulate these lists on the dark web,” Lawrence Pingree, a vice president at Dispersive, said, “sometimes repackaged several times, sometimes sold on an individual basis.” As Pingree told me, it’s hard to tell without examining the entire dataset, deduplicating the data, and comparing it to standalone breach datasets whether this is a repackaged leak or not. However, the Cybernews researchers are sure it is not. Whatever, as Pingree said, “16 billion records is a large number,” and such credentials data “can be misused and is misused - that's what makes it valuable.”

The 16 billion strong leak, housed in a number of supermassive datasets, includes billions of login credentials from social media, VPNs, developer portals and user accounts for all the major vendors, apparently. Remarkably, I am told that none of these datasets have been reported as leaked previously, this is all new data. Well, almost none: the 184 million password database I mentioned at the start of the article is the only exception. That has been contested by some cybersecurity professionals, but whatever the truth of the matter it remains a huge cause for concern.

“This is not just a leak – it’s a blueprint for mass exploitation,” the researchers said. And they are right. These credentials are ground zero for phishing attacks and account takeover. “These aren’t just old breaches being recycled,” they warned, “this is fresh, weaponizable intelligence at scale.”