Chances are you’ve heard about the 16 billion login credentials being leaked online, which is being hailed as the ‘biggest cybersecurity breach’ ever. However, there’s little clarity about the origin and time of this breach. Here are our two cents on the matter.

We believe that this is not a fresh or new data leak but rather a compilation of previously leaked credentials stuffed into several databases, which a security research firm, Cybernews, has then discovered.

The datasets were only exposed briefly, enough for the security firm to acknowledge their existence. However, it’s still unknown which organizations are behind the breach.

Cybernews said that it had been tracking the web since the beginning of 2025 and has found 30 such datasets so far, containing a total of 16 billion records. Out of this, only one data set containing 184 million records was reported earlier. This means that the rest of the records are ‘new knowledge’ for everyone.

However, this still doesn’t mean that this is a new leak – your passwords and credentials were not stolen last week or last month. Instead, they could have been stolen two years back and leaked on the internet, and the researchers have just found out about it now.

Nonetheless, the sheer number of login credentials leaked was enough to send shockwaves through the cybersecurity world. This is not just a company-specific cyberattack.

Credentials from all platforms you can imagine (Google, Meta, GitHub, Telegram, Microsoft, and pretty much any online service you use) may have been leaked. Oh, how aptly did they put it when they said, ‘If data is the new gold, this lead database is a massive gold mine.’

What Makes This 16 Billion Leak So Alarming?

Malicious actors will use these credentials for mass-scale stuffing attacks, where they use advanced algorithms to test these stolen credentials across millions of websites. For instance, if your Instagram password was leaked, hackers will use it to log in to other websites in case you use the same password across different platforms.

Then comes the menace of account hijacking. Once the hackers are inside your account, they can use it for pretty much anything: identity theft, blackmail, or financial theft. Compromised devices can also be used as botnets to deploy spam or DDoS attacks.

The Work of Infostealers?

This 16 billion data leak is said to be the work of infostealers, which are basically malware designed specifically for stealing sensitive credentials. Infostealers are delivered through classic methods, such as phishing emails, malicious websites, or malvertising.

Once they’re inside your system, they can snoop in on all your saved passwords, browsing data, and cookies on browsers such as Chrome, Firefox, and Edge. Plus, app credentials like Discord tokens, social media logins, and crypto wallet private keys are also unsafe.

Some popular info dealers, such as Redline and Aurora, are notorious for stealing browser and crypto data. This collected data is then sent to the threat actor who has deployed the malware, which is then used for mass-scale cyberattacks.

What Can You Do to Protect Yourself?

As much as we’d like there to be a one-stop solution to keep our data safe from snoopers and hacks, there isn’t one. The only thing you can do to stop your personal data from being leaked is maintain proper online hygiene.

For starters, do not open any suspicious websites or emails or click on any unknown links without first verifying the source. Secondly, maintain good password hygiene: use different passwords for every online account and avoid common passwords like 12345678 and the like.

🔐 As much as 78% of users admit to using the same password for most of their accounts.

🔐 Cybernews conducted a thorough research of 19B leaked passwords and found that only 6% of them were unique. 

🔐 Plus, 64% of Americans use passwords between 8-11 characters, whereas the recommended length is at least 12.

One of the most talked-about security measures is multifactor authentication (MFA). This essentially means that you’re securing your account with not one but two passwords.

This includes a primary text-based password and a secondary temporary authentication using an external authenticator app or a simple one-time password sent to your phone.

So, even if the first password is leaked, the hackers cannot get into your account unless they have the second temporary password, which is really tough to acquire. Despite its usefulness, only 50% of IT professionals use MFA, and around 55% of small businesses are not aware of it at all.

While our recommended security measures are pretty basic, stats show that people are just too lazy to follow them. The fact that a huge 16 billion database has been found goes to show how unaware or unbothered the public at large is.

Security researchers have been begging users to follow proper password hygiene and enable MFA on their accounts. It’s then, frankly, just our carelessness that leads to huge breaches like this.

Even though the cat has left the bag, it still might not be too late. Start by changing the passwords of all your major accounts, such as banks and social media.

Next, keep updating these passwords every 3-6 months (or even more frequently if you can). You can also use a password manager, preferably one that stores your data locally and not on the cloud.