World’s largest password leak: 16 billion login credentials leaked, sensitive data from Apple, Google, Facebook, Telegram now...

In what is being called the biggest data breach ever recorded, cybersecurity experts have uncovered a leak involving over 16 billion stolen login credentials, passwords, and sensitive user data from some of the world’s most widely used online services. The discovery was made by a team of researchers at Cybernews, led by Vilius Petkauskas, who have been working on the investigation since early 2025. According to their findings, the stolen data comes from 30 different data dumps, each containing anywhere between tens of millions and over 3.5 billion records. The total number of exposed accounts has now reached a shocking 16 billion. These leaked credentials are believed to have been collected through infostealer malware, a type of malicious software that secretly collects usernames, passwords, and other private information from users' devices without their knowledge. The stolen data reportedly includes login information for popular platforms such as Apple, Google, Facebook, GitHub, Telegram, and even government websites.

Petkauskas explained to Forbes that most of the information has been stored in simple formats, URLs followed by usernames and passwords, making it extremely easy for hackers to misuse the data. He warned, “This is not just a leak. It’s a blueprint for mass exploitation.”

These stolen details are a goldmine for cybercriminals, who can now launch phishing attacks, account takeovers, and even try to gain access to corporate systems. Unlike past data breaches, this one contains a fresh mix of stolen data, not just recycled information from old hacks.

What Can You Do to Protect Yourself?
Experts are urging people to take action now. Darren Guccione, CEO of Keeper Security, recommends that individuals use strong, unique passwords for every account and consider password manager apps to help keep track of them. He also suggests using dark web monitoring tools that alert users if their information appears in stolen databases. Most importantly, enable multi-factor authentication (MFA) wherever possible. This adds an extra layer of security, making it harder for hackers to access your accounts, even if they have your password.

In short, cybersecurity is not just a job for IT teams anymore, it’s everyone’s responsibility. With such a massive amount of personal data now in the wrong hands, staying alert and updating your online safety habits has never been more important.