16 Billion Passwords Leaked: Myth vs Reality

A leak involving well over 16 billion credentials has made headlines recently, but a lot of the coverage about it is inaccurate. This leak is basically a vast collection of previously released data that was collected over time from numerous sources rather than a single, brand-new data breach.

Decoding the Credential Leak With Focus on Its Origins, Composition, and Impact

The issue of widespread credential leaks has persisted for quite some time; it is far from new. One of the earliest widely reported compilations was the 2019 "Collection #1" breach, which contained approximately 773 million unique email addresses and passwords compiled from hundreds of smaller leaks (Hunt, 2019). This event highlighted how cyber adversaries aggregate data from various sources to create extensive pools of credentials for malicious exploitation.

Security expert Troy Hunt, the creator of the well-known breach notification service Have I Been Pwned, has been instrumental in raising awareness of such breaches. In March 2025, Hunt himself became a victim of a sophisticated phishing attack that compromised his Mailchimp mailing list, exposing the email addresses of 16,000 subscribers(Hunt, 2025). His candid disclosure underscored that no one, not even seasoned cybersecurity professionals, is entirely safe from attacks.

The narrative of the huge credential leak that is making headlines right now initially began on May 22, 2025, when cybersecurity researcher Jeremiah Fowler found and reported to Website Planet about a database that had been publicly available yet not password protected and had 184 million unique login credentials. This 47.42 GB database had login information for many different services, such as Facebook, Instagram, Snapchat, Roblox, and more, as well as major email providers (Fowler, 2025).

Soon after Fowler's responsible disclosure, public access to the database was restricted. To verify the data’s authenticity, Fowler reached out to multiple individuals listed in the database, who did confirm that their credentials were accurate. Major blog posts such as Wired magazine and Mashable featured this discovery.

On June 18, 2025, Cybernews published findings concerning an even larger aggregation: 16 billion login credentials dispersed across 30 different databases. Cybernews stressed that the data was current and not merely recycled from previous breaches, although further analysis indicates it is a mix of both new and old data.

This enormous dataset includes various credential dumps, such as reused passwords from past breaches, malware logs from infostealers like LummaC2, StealC, and Redline, along with other smaller data dumps. Similar to the 2019 "Collection #1" breach, this current compilation amalgamates numerous datasets collected by a small group of threat actors.

Many of these records are old or duplicated because they come from many different sources and times. Still, the large amount of data from many different sources makes this leak important because it provides cyber adversaries with a pool of credentials for credential stuffing attacks.

To provide context on how info stealers operate,

An infostealer is a type of malware designed to secretly infect devices and steal sensitive information, such as saved passwords, cookies, and files. Attackers commonly distribute this malware through phishing emails, fake or compromised websites, malicious downloads, or Trojan software.

Once the malware is on the device, it discreetly collects data and encrypts it. Thereafter, the obtained data is transmitted back to the intruder's Command and Control (C2) server, often using encrypted channels to avoid getting caught. The C2 server can not only receive the data, but it can also send commands back to the infected device, enabling attackers to control it remotely.

Following the exfiltration process, initial access brokers purchase the stolen data from logs and sell it on the black market. These brokers buy access to hacked accounts or systems to make it easier for threat actors to carry out more attacks, like phishing campaigns. (Maguire, 2024). This Malware-as-a-Service (MaaS) model allows even novice hackers, often referred to as script kiddies, to acquire ready-made infostealer tools and access stolen data.

Why the Recent Headlines Are Misleading

The headlines suggesting a single breach exposing “16 billion credentials” cause unnecessary alarm.

In reality:

The number is higher than it should be because it includes a lot of old and repeated credentials.

This leak doesn't come from just one recent breach as initially claimed; it's a collection of many past breaches, malware logs, and smaller data dumps that have been collected over time.

Cybernews subsequently presented screenshots of Elasticsearch logs formatted in JSON, including timestamps from February 20, 2025, and April 30, 2025. However, these dates do not confirm that the entire dataset is new.

Elasticsearch timestamps indicate the time assigned to each event; however, they do not necessarily reflect the time of the event's initial creation or exfiltration.

To better understand what these logs represent, let’s break down a typical JSON log snippet:

index - This indicates the Elasticsearch index where the log entry is stored. In this case, "ctionbudget-unamepass" likely refers to a collection of username and password data.

score - This is Elasticsearch’s relevance score for search results; a value of null indicates that no score has been applied.

source - Contains the original event data stored in Elasticsearch.

@timestamp - Records the exact time the event occurred, following the ISO 8601 format. For example, “2025–04–30T21:12:34.877Z” means the event happened on April 30, 2025, at 21:12:34 Coordinated Universal Time (UTC).

@version - Indicates the version of the log format or schema, here set to “1”.

The domain involved in the event is indicated by "accounts.google.com", which refers to Google account activity.

The host, "cc7d803cd7db", is the identifier of the machine or server that recorded the event.

message - The event details, often including HTTP requests like masked login attempts, e.g.,

The timestamps recorded in the logs may differ from the original event time due to Elasticsearch’s capability to incorporate custom timestamp fields, as well as potential modifications or assignments of timestamps during the indexing process by ingestion pipelines. The difference is important because the timestamp in Elasticsearch logs might not show the real time when the event happened, especially if the data was re-indexed, delayed, or changed during the ingestion process.

Also, major companies mentioned, including Apple, Google, Facebook, GitHub, and Telegram, have not issued any official breach notifications or disclosures. This situation is unusual because these companies have strict rules for how to respond to breaches. For instance, US regulators require them to notify regulatory authorities within 72 hours, make public announcements, and directly inform affected users. The lack of such notifications suggests that the leak may not involve recent compromises (PwC, 2022).

The Bottom Line

This serves as a gentle reminder. I understand that your schedules are busy, but you can spare just five minutes a day to take simple yet effective steps that significantly reduce your risk and help protect your online identity:

1. Check for exposure - Utilise dark web monitoring tools such as haveibeenpwned.com and Mozilla Monitor to determine if your email or passwords have appeared in known breaches or are being traded online. If you discover any exposure, please promptly update your passwords and implement the necessary security measures.
2. Audit you accounts - Regularly review your online accounts for any suspicious activity or unauthorised access.
3. Update passwords frequently - Employ strong, unique passwords for every account. Using tools like PowerShell scripts or Microsoft Power Automate, you can set up automatic reminders and notifications for password expiration. This way, you can get updates on time without having to do anything yourself. Password managers can also help you make and keep track of complicated passwords safely.
4. Check Third-Party Access - Get rid of any apps or services that aren't being used that are linked to your accounts, especially if you use single-sign-on (SSO) options like Google or Facebook.
5. Before you click link, make sure it is safe. Only download software from websites that you know and trust. To be safe, use services like VirusTotal to check download links and files for malware or phishing threats before you continue.

You don't have to worry about these credential leaks, especially if you maintain consistent password hygiene. You can greatly lower your risk and keep your digital life safe by taking incremental steps ahead of time. If you ever feel unsure or need help, don't hesitate to contact your IT team or a security expert you trust. For your safety and that of your loved ones, we are always here to help you keep your digital space safe. We can stay one step ahead of cyber threats if we work together.

Cheers!