16 Billion Password Breach: Check If You’re Affected

If you’ve been online this week, you’ve seen the headline: 16 billion passwords leaked — but this is a compiled arsenal of stolen credentials gathered over years, not a single breach. Understanding what that means is the first step to protecting yourself.

Total leaked credentials: 16 billion ·
Date of disclosure: June 2025 ·
Affected platforms: Google, Facebook, Apple ·
Primary risk: Credential stuffing attacks

Five key facts frame this massive leak:

Is it true that passwords have been leaked?

What do we know about the scope of the leak?

• The dataset is a compilation, not a single hack. GRC Solutions tracked roughly 30 distinct datasets combined into one file.
• The leak affects users of almost every major platform. Forbes reported the data includes credentials for Google, Apple, Facebook, and hundreds of other services.
• At 16 billion records, this is widely regarded as the largest collection of stolen credentials ever assembled.

The sheer volume makes it a valuable resource for attackers—but the compilation nature means it’s largely old data aggregated over years, not a single dramatic intrusion into a current system.

How reliable are the initial reports?

Cybersecurity experts widely agree that the dataset represents a serious threat. Kaspersky noted in its analysis that users should act immediately, and McAfee confirmed the leak’s immense scale. The consensus is clear: the data is real, and it is dangerous.

How did 16 billion passwords get leaked?

Was it a single breach or a collection?

• According to GRC Solutions, the dataset is an aggregate of roughly 30 different caches of stolen credentials.
• Forbes confirmed the data was compiled from multiple infostealer operations, not a single system breach.
• The records were collected over several years, meaning the data ranges from very recent to a decade old.

This is a crucial distinction: no single company was hacked to produce this trove. Instead, it’s an encyclopedia of previous failures.

Who published the data?

• The data was posted on a well-known cybercrime forum.
• Forbes reported the thread has since become a central resource for credential stuffing attacks.
• The identity of the publisher remains unknown.

Posting stolen data on forums is a standard tactic in the cybercrime economy, used to establish reputation or simply to disrupt.

What is a credential compilation?

A credential compilation is exactly what it sounds like: a giant spreadsheet of usernames, emails, and passwords assembled from decades of data breaches and infostealer logs. GRC Solutions notes that collections like these are the primary fuel for automated account takeover attacks. This particular compilation, per Cybernews, contains individual datasets ranging from tens of millions to more than 3.5 billion records.

The pattern: We are seeing a shift from targeted hacking to industrial-scale credential aggregation. Attackers don’t need to breach your bank directly if they already have the password you used there from a forum account you made in 2018.

How to check the 16 billion passwords leaked?

Using Have I Been Pwned?

• Have I Been Pwned is a free, widely trusted service that lets you search across billions of known breach records.
• Its Pwned Passwords feature allows you to check if a specific password has appeared in a compromised dataset without exposing the password itself, using a method called k-anonymity.
• If this compilation has been indexed, your email or password will return a result immediately.

Checking your email address

• SecurityScorecard advises users to visit Have I Been Pwned and enter their email address.
• The service will immediately show which previous breaches your credentials have appeared in.
• If your email isn’t listed yet, check back over the coming weeks as security researchers ingest the new data.

Using password manager tools

• F-Secure offers a free identity-theft checker that scans for your personal information in known breaches.
• Many modern password managers, such as the one built into Google Chrome, automatically alert you if your saved passwords appear in a new leak.
• Google’s Password Checkup is a built-in tool for Android and Chrome users that runs a silent scan against known breach databases.

For more on verifying large data exposures, see our Epstein Files analysis.

Do I need to worry about the password leak?

Who is at risk?

• If you reuse passwords across multiple sites, you are at high risk.
• Cloudflare explains that credential stuffing relies entirely on password reuse.
• If your login from a breached forum in 2018 is the same as your current email password, your email account is effectively compromised.

What are the consequences of credential exposure?

How credential stuffing works

• Imperva defines credential stuffing as the automated injection of stolen username/password pairs against website login forms.
• Attackers use bots to rapidly test billions of combinations, relying on the fact that people reuse passwords.
• These automated attacks are designed to look like normal traffic, making them hard to block without dedicated mitigation tools. (GRC Solutions)

The trade-off: Convenience versus security. Every reused password lowers the barrier for an attacker. The decision to use unique passwords is a direct bet against a very specific, very probable attack vector.

What to do after the 16 billion passwords data breach?

Change passwords on all important accounts

1. Start with your email accounts. If an attacker gets your email, they can reset everything else.
2. Next, prioritize financial accounts: banking, investing, PayPal.
3. Finally, change passwords on social media and shopping accounts.

Google Support recommends running a Security Checkup and Password Checkup to identify all compromised passwords across your Google account at once.

Enable two-factor authentication

• OWASP states that multi-factor authentication (MFA) is the single most effective defense against credential stuffing attacks.
• OWASP cites Microsoft analysis indicating MFA would have stopped 99.9% of account compromises.
• Enable it on email, banking, and any platform that offers it—especially those using authenticator apps or hardware keys.

Use a password manager

• Password managers generate and store unique, complex passwords for every site.
• This completely eliminates the risk of credential stuffing because no password is ever reused.
• Most managers also have a built-in security dashboard that alerts you if a stored password appears in a known breach.

For related device security tips, see our iPhone network reset guide.

Monitor accounts for suspicious activity

• Check your recent login history on critical accounts.
• Set up notification alerts for new device logins wherever possible.
• SecurityScorecard recommends watching for breach notification emails from services you use.

Confirmed Facts vs. What’s Unclear

What Security Experts Are Saying

The 16 billion-credential cache was assembled from roughly 30 datasets, with individual datasets ranging from tens of millions to more than 3.5 billion records.

Cybernews (cybersecurity research publication)

Multi-factor authentication is the best defense against most password-related attacks, including credential stuffing and password spraying.

OWASP (open web application security project)

Credential stuffing is a cyberattack that uses stolen login credentials from one breach to gain access to accounts on other services.

Cloudflare (web performance and security company)

The 16 billion password leak is a wake-up call for anyone who has ever used the same password on more than one website. The security industry has the tools to stop credential stuffing cold—password managers, multi-factor authentication, and breach monitoring services. The weak link is human nature. For anyone still relying on a handful of shared passwords, the choice is stark: adopt a password manager and multi-factor authentication today, or accept the near-certainty of an account takeover tomorrow.

Frequently asked questions