A Wake‑Up Call for Digital Security: 16 Billion Credentials Exposed

It’s time for every organization to act now—before the access to 16 billion credentials becomes a breach in their own fortress.

In late June 2025, cybersecurity researchers at Cybernews, partnered with expert Bob Diachenko, uncovered 30 unsecured databases containing over 16 billion login credentials—including actual passwords—collected via “infostealer” malware and historical breaches . These troves briefly went public due to misconfigured servers.

Unlike a single corporate breach, this leak stems from multiple sources: 85% from real-time malware, 15% from older leaks like LinkedIn

Why This Is More Than Just Another Leak 📌

Size & freshness: It’s the largest credential leak ever—enough for every person on Earth to have two credential records .
Structured data: Each record follows “URL – username – password” format—perfect for hackers to automate account takeover attempts .
Real-world impact: Credentials span major platforms—Apple, Google, Facebook, Telegram, government portals—making identity theft and phishing far more likely

What Experts Recommend (And What We Promote at Compliancert)

Change passwords immediately: Don’t wait — if you’ve reused passwords, change them across all accounts and on linked systems .
Use strong, unique passwords + a manager: Avoid simple, easy-to‑guess words. Use passphrases or a reputable password manager to generate and store random credentials .
Enable multi-factor authentication (MFA) or passkeys: Add an extra layer of security. Wherever possible, switch to passkeys—they’re more secure than traditional passwords .
Check if your email appeared in prior breaches: Use tools like HaveIBeenPwned to verify .
Monitor suspicious logins: Watch for account activity alerts, and act fast if something’s amiss .
Stay alert against phishing: With this data trove circulating, expect more targeted attempts. Relying on password-only protection is no longer safe

Why This Matters for Your Company

Risk of mass credential stuffing: Reused passwords across work accounts could allow attackers to breach enterprise systems.
Regulatory duty of care: Under GDPR and similar regulations, data controlers/processors must proactively prevent unauthorized access .
Business loss prevention: A single compromised admin password can trigger service disruptions, financial fraud, and reputational damage.