Massive 16 Billion Password Leak Raises Global Cybersecurity Alarms

It is being described as the largest password leak in history, as cybersecurity researchers have uncovered a staggering 16 billion compromised login credentials, exposing a major global security risk. The leak, uncovered by Cybernews researchers as part of an investigation that began earlier this year, is believed to be the result of multiple infostealer malware attacks. The exposed data spans social media platforms, VPNs, developer portals, and even government services.

The researchers reported that 30 massive datasets, each containing tens of millions to over 3.5 billion records, were discovered. Unlike previous breaches that often repurpose old data, this collection appears largely new, with only one previously reported leak of 184 million passwords overlapping. Experts warn that these credentials, often sold or traded on the dark web, can lead to mass phishing campaigns, identity theft, and unauthorised access to critical systems.

Security professionals, including former NSA expert Evan Dornbush and executives from Keeper Security and Dashlane, stress the urgency of adopting stronger password practices and technologies such as passkeys and zero-trust security models. They urge individuals to avoid password reuse, use password managers, and enable dark web monitoring to catch exposures early.

Among the affected services are major tech giants such as Apple, Google, Facebook, and GitHub, all of which host vast numbers of user accounts tied to personal, professional, and developer activities. Communication platforms like Telegram are also included, alongside numerous VPN services and developer portals.