16 Billion Passwords Leaked (2025): How to Check if You’re Affected & Stay Safe

 
Updated June 22, 2025 – A record-breaking leak of login credentials—totaling 16 billion—has been confirmed by cybersecurity researchers. This may be the largest credential leak in history, dwarfing previously reported breaches. Researchers link this data exposure to multiple infostealer malware campaigns, not a centralized breach of companies like Google, Apple, or Facebook.

The leaked information, much of it previously unknown, is reportedly organized into 30 massive
datasets. Some datasets hold over 3.5 billion records each, comprising email and password combinations from social media platforms, VPN providers, developer portals, cloud tools, and government websites. While the sheer scale is shocking, the implications are even more serious: these credentials can be used for phishing, account takeover, and broader cyberattacks.

What This Leak Includes

According to cybersecurity researcher Vilius Petkauskas at Cybernews, the leak is not just recycled data from past breaches. Researchers affirm the majority of credentials are newly exposed. Bob Diachenko, a well-known cybersecurity analyst at SecurityDiscovery.com, confirmed that although login URLs linked to major services like Apple and Google appear in the logs, there was no direct breach of these companies. Instead, the credentials were harvested by malware infecting users’ devices.

What You Should Do Now

Whether or not your specific information was part of this leak, cybersecurity experts are urging everyone to take action:

• Change Your Passwords Immediately — especially if you reuse passwords across multiple sites.

• Enable Multi-Factor Authentication (MFA) on every account that supports it.

• Use a Password Manager to generate and store strong, unique passwords.

• Monitor for Unusual Activity — consider using a dark web monitoring tool to alert you if your credentials appear in future leaks.

Shift From Passwords to Passkeys

One of the most secure alternatives to traditional passwords is passkey technology. Unlike passwords, passkeys rely on cryptographic keys stored on your devices and protected with biometric or device-level authentication. Apple, Google, and Facebook have all begun rolling out passkey support.

• How to switch to passkeys for your Google Account

• How to set up passkeys with Apple ID

• How to enable passkeys for Facebook

Industry Reactions

Experts emphasize that credential theft is no longer an isolated threat—it’s systemic.

"It doesn’t matter how complex your password is. When an attacker compromises the database that stores it, they have it," says Evan Dornbush, a former NSA cybersecurity expert. This is why password reuse is especially dangerous.

George McGregor, VP at Approov, likens this leak to the first domino in a chain reaction of cyberattacks. He and others point out that identity-based threats are now mainstream, and that most individuals already have compromised data floating around on the dark web.

Darren Guccione, CEO of Keeper Security, added that this event underscores the risk of misconfigured cloud storage and accidental exposure of sensitive information. He advises both individuals and organizations to adopt zero-trust security models and prioritize privileged access control.

Cybersecurity Responsibility: Shared or Not?

While many in the industry argue cybersecurity is a shared responsibility between users and providers, some experts disagree. Paul Walsh, CEO of MetaCert, argues that the onus should be on platforms to protect users from phishing and malware, stating that blaming users for security failures has not been effective.

Final Recommendations

• Stop reusing passwords.

• Enable passkeys where supported.

• Use password managers and MFA.

• Watch for phishing attempts and fake login pages.

• Consider enabling security alerts for unauthorized access attempts.

This breach may not be the last, but by updating your security habits now, you can significantly reduce your exposure.