The 16 Billion Password Leak: What It Really Was

The "16 billion password leak" of June 2025 was not a new hack of Google, Apple or Facebook. It was a pile of login details, mostly collected over time by infostealer malware and from older leaks, that researchers found sitting on unprotected servers. The headline number was scary, but the right response is calm and simple: unique passwords, a password manager and multi-factor authentication.

What happened in June 2025

Researchers at Cybernews reported that they had found 30 exposed datasets, on misconfigured Elasticsearch and cloud storage servers, adding up to about 16 billion records. Individual datasets ranged from tens of millions to about 3.5 billion records, according to CyberInsider's summary. The data included logins for services such as Apple, Facebook, Google and Telegram.

Many news sites ran it as "the largest data breach in history". Within a day, security reporters pushed back.

Was the 16 billion password leak a real breach?

Not in the usual sense. BleepingComputer, writing on 19 June 2025, put it bluntly: this was not a new data breach. The datasets were a compilation of credentials stolen by infostealers, exposed in older breaches, or used in credential stuffing. None of the named companies had been hacked to produce it.

A few points worth knowing:

• It's a compilation, not one breach. Think of it as many old filing cabinets dumped into one warehouse.
• There are duplicates. The same email and password often appears many times across datasets, so 16 billion records does not mean 16 billion people or accounts.
• "Newly found" is not "newly stolen". BleepingComputer noted there was no evidence it held new, never-seen data. Some of it may be recent; much of it is likely months or years old.

What is an infostealer?

An infostealer is malware that quietly copies saved passwords, browser cookies and other data from an infected computer. It often arrives through pirated software, fake game cheats, or a dodgy download link.

The stolen data is usually saved as a "log" per victim: website, username and password, line by line. Those logs get sold and shared among criminals, and then bundled into huge collections like this one.

The worrying part is cookies. A session cookie is what keeps you logged in. If a thief copies it, they may be able to use your account without needing your password or your second login step, until that session expires or is revoked.

So is there any real risk?

Yes, just not the panic version. Old passwords still work if people never changed them, and many people reuse the same password across sites.

That is exactly how credential stuffing works: criminals take leaked email-password pairs and try them automatically on banking, email and shopping sites. Verizon's 2025 Data Breach Investigations Report found that credential abuse was the most common way attackers got into organisations, at 22% of breaches. In the 2026 edition it fell to 13%, overtaken by exploited software flaws, but it is still one of the main ways in.

So if your Shopee, Gmail and company VPN all share one password, any leak anywhere puts all three at risk.

What to do (individuals)

1. Check your email on Have I Been Pwned, a free service that tells you which known leaks include your address.
2. Scan your computer first if you suspect malware. BleepingComputer's advice is to clean the machine before changing passwords, or the infostealer simply grabs the new ones.
3. Use a password manager and give every site its own long, random password.
4. Turn on multi-factor authentication (MFA), ideally an authenticator app or passkey rather than SMS codes, which can be hijacked through SIM swapping.
5. Change passwords that you've reused, starting with email and banking. You don't need to change everything at once.
6. Sign out of other sessions on important accounts (most services have a "sign out everywhere" option). This kills stolen cookies.

What to do (businesses)

For a business, the lesson is that staff passwords are probably already in someone's leaked dataset. Plan for that.

• Require MFA on email, cloud apps, VPN and admin accounts. Prefer phishing-resistant options like passkeys or security keys for admins.
• Block known-leaked passwords when staff set new ones. Many identity platforms can check against breach lists.
• Watch for odd logins, such as sign-ins from new countries or many failed attempts in a short time.
• Keep work and personal browsing apart. Infostealers on a home PC used for work can leak company logins.
• Shorten session lifetimes for sensitive systems so stolen cookies expire faster.

These steps fit naturally into a zero trust approach, where no login is trusted just because the password was right. For the wider picture of how breaches happen and what to do, see my data breach guide.

Conclusion

The 16 billion password leak was mostly recycled data with a dramatic headline. The real lesson is older and more boring: reused passwords and infostealers are how accounts get taken over. Unique passwords, a password manager and MFA protect you from this leak and the next one.

Quick answers

Was Google or Apple hacked in the 16 billion password leak?

No. Reporters found no evidence that any of the named companies were breached. The logins were collected from infected devices and older leaks.

Should I change all my passwords?

Change any password you've reused, starting with email and banking, and turn on MFA. A password manager makes this much easier.

How do I know if my password was leaked?

Check your email on Have I Been Pwned. Many password managers also warn you about leaked or reused passwords.

Does MFA stop infostealers?

MFA stops most attacks using stolen passwords alone. It may not stop a stolen session cookie, so also sign out of old sessions and keep your device free of malware.