In what cybersecurity experts are calling the largest data breach in history, a staggering 16 billion login credentials have been leaked online, affecting some of the world’s most prominent platforms, including Apple, Google, Facebook, Telegram, and several government portals.
The breach was uncovered by a team of cybersecurity researchers at Cybernews, led by Vilius Petkauskas, who have been investigating the leak since early 2025. Their findings, first reported by Forbes, suggest that the compromised data stems from 30 separate data dumps, each containing tens of millions to over 3.5 billion stolen records.
“This is not just a leak – it’s a blueprint for mass exploitation. These credentials are ground zero for phishing attacks and account takeover; these aren't just old breaches being recycled,” the researchers warned.
The leak includes sensitive information such as usernames, passwords, and login data for social media, virtual private networks (VPNs), developer tools, and various online services. Among the affected are users of Apple, Google, Facebook, GitHub, Telegram, and even official government digital platforms.
The team attributes the breach to infostealer malware—malicious software that silently gathers personal information from infected devices, often without users' knowledge.
According to Petkauskas, “Most of the stolen info is formatted as simple URL links followed by usernames and passwords. In short, if you’ve ever logged into anything online, your information could be in this leak.”
The magnitude and scope of the breach have raised serious alarm bells across the tech and security communities. Darren Guccione, CEO and co-founder of Keeper Security, a privileged access management platform, told Forbes, “Consumers should invest in password management solutions and dark web monitoring tools more than ever.”
Also read: 15 lakh cyber attacks by Pak hackers on India, only 150 succeeded
He added that cybersecurity is now not merely a technical concern but a shared public responsibility. Users, he said, must take immediate steps to strengthen their online safety practices.
Time to act: What can be done
Experts recommend that individuals affected or potentially exposed should:
- Use strong, unique passwords for all services.
- Implement multi-factor authentication (MFA) wherever possible.
- Adopt password managers to safely store and update credentials.
- Monitor the dark web for unauthorised use of their data.
The breach serves as a stark reminder that digital hygiene and awareness are more critical than ever, as hackers adopt increasingly sophisticated tactics to mine personal data for financial and political gains.
Earlier breaches of similar nature—though significant in scope—pale in comparison to the sheer volume of compromised information revealed in this instance.
Authorities across several countries are expected to launch coordinated investigations to trace the origin and fallout of the breach, while tech firms are likely to issue advisories in the coming days.
Follow us
