Top

16 Billion Login Credentials Allegedly Leaked, Impacting Apple, Google, Facebook And More

The stolen credentials were sourced from social media, corporate systems, VPNs, and developer portals

Researchers have claimed to have uncovered one of the largest data breaches in history, involving more than 16 billion login credentials.
According to a report by Cybernews, the researchers discovered 30 exposed datasets, each containing anywhere from tens of millions to over 3.5 billion records. The leaked accounts include those from major platforms such as Apple, Facebook, Google, GitHub, Telegram, and even various government services.
The report suggests that the credentials may have been leaked by cybercriminals using infostealers, a malicious software designed to steal data.
The stolen credentials were sourced from social media, corporate systems, VPNs, and developer portals, the report added.
“This is not just a leak—it’s a blueprint for mass exploitation,” the researchers warned. “With over 16 billion login records exposed, cybercriminals now have unprecedented access to personal credentials that can be used for account takeovers, identity theft, and highly targeted phishing campaigns. What’s especially concerning is the structure and recency of these datasets—these aren’t just recycled breaches. This is fresh, weaponizable intelligence at scale.”
What Information Is Included in the Leaked Data?
Researchers stated that the leaked data contains a mix of information from stealer malware, credential stuffing sets, and repackaged leaks. However, they acknowledged that it’s impossible to determine exactly how many individuals or accounts were exposed.
However, the team that gathered the data followed a specific structure: a URL, followed by login details and a password. This format aligns with the method used by modern infostealers to steal data.
According to the researchers, such datasets are used in phishing campaigns, account takeovers, ransomware intrusions, and business email compromise (BEC) attacks. The leaks also contain tokens, cookies, and metadata — posing a significant threat to organizations that lack multi-factor authentication or proper credential hygiene practices.
( Source : Deccan Chronicle )
Next Story