Be Quick, Change Your Passwords: Biggest Password Breach in History Exposes 16 billion Credentials

Experts warn that the newly discovered trove of credentials isn’t outdated—it’s fresh, organized, and built for exploitation.

BY PC Bureau

New Delhi, June 20, 2025 – Cybersecurity researchers from Cybernews have uncovered the largest data breach ever recorded, exposing over 16 billion usernames and passwords stolen by cybercriminals using sophisticated malware. The colossal dataset, discovered in unsecured online storage, includes login credentials from major platforms such as Google, Apple, Facebook, GitHub, Telegram, LinkedIn, Netflix, and Amazon, among others. Experts warn that the breach’s scale and recency make it a “blueprint for mass exploitation,” posing severe risks of identity theft, account takeovers, and targeted cyberattacks.

The Cybernews team identified 30 distinct datasets, ranging from millions to billions of records, with only one dataset—containing 184 million passwords—previously reported. The remaining 99% of the data is new, collected in 2024 through info-stealer malware like RedLine, Vidar, and Lumma. These malicious programs target social media accounts, corporate websites, VPNs, and developer platforms, extracting URLs, usernames, passwords, and, in some cases, security tokens and API keys. The datasets’ structured format amplifies their potential for automated attacks like credential stuffing, where stolen logins are tested across multiple services.

The breach was briefly accessible through misconfigured cloud storage, likely S3 buckets, allowing researchers to analyze the data but not trace its controllers. Cybersecurity experts describe the exposure as a “wake-up call,” with the data’s recency and organization heightening risks for both individuals and organizations. “This isn’t just a leak; it’s a goldmine for cybercriminals,” said Dr. Ankit Sharma, a cybersecurity analyst at Delhi-based SecureNet Solutions. “Without multi-factor authentication, millions of accounts are vulnerable to takeover.”

READ: Analysis: Record Spike in Swiss Bank Deposit Revives Talk of India’s Economic “Loot”

The breach’s implications are far-reaching. Individuals face risks of identity theft, financial fraud, and phishing attacks, while companies are exposed to ransomware, data breaches, and supply chain attacks, particularly through compromised GitHub accounts. A 2024 Verizon report notes that 68% of breaches involve stolen credentials, with ransomware incidents doubling since 2022. In India, where the average cost of a data breach reached ₹9.4 crore in 2023, per IBM, the fallout could be economically devastating.