History’s Largest Data Breach: 16 Billion Passwords Leaked Across Apple, Google, Facebook, and More

In a staggering revelation, security researchers have uncovered what is being described as the largest data breach in history, exposing approximately 16 billion login credentials, including usernames, passwords, session cookies, and access tokens, from a wide array of platforms such as Apple, Google, Facebook, GitHub, Telegram, VPN services, and even government portals. Reported by Forbes, Cybernews, and other outlets, this massive leak, discovered across 30 online datasets, poses unprecedented risks for account takeovers, identity theft, and targeted phishing attacks. Here’s everything we know about the breach, its implications, and how to protect yourself.

The Scope of the Breach

The breach, detailed in reports from June 19, 2025, involves 30 separate datasets, each containing tens of millions to over 3.5 billion records, collectively amassing 16 billion compromised credentials. According to Cybernews, the data is structured in a way that suggests it was collected by infostealer malware, which captures sensitive information like URLs, usernames, and passwords directly from users’ devices. Unlike older breaches that often recycle outdated data, researchers emphasize the “recency and structure” of these datasets, indicating that much of the information is fresh and highly exploitable.

The affected platforms span nearly every major online service imaginable:

• Social Media and Tech Giants: Apple, Google, Facebook, Instagram, Snapchat, and Microsoft accounts are heavily represented.
• Communication Platforms: Telegram and other messaging services are included.
• Developer Platforms: GitHub credentials, critical for software developers, are part of the leak.
• VPNs and Government Services: Logins for VPN providers and various government portals, potentially compromising sensitive access, are also exposed.

Only one of the 30 datasets, containing 184 million records, had been previously reported, leaving the vast majority of this breach previously undisclosed. This “mysterious” 184 million-record database, discovered by security researcher Jeremiah Fowler in May 2025, included credentials for Google, Microsoft, Apple, and others, and was taken down after its discovery. However, the remaining datasets, totaling billions more, have raised alarms due to their scale and accessibility.

How Did This Happen?

The structure of the leaked data—organized as URL, username, and password—points to infostealer malware as the primary culprit. This type of malicious software infects users’ devices, often through phishing emails, compromised websites, or unsecured downloads, and silently collects login credentials as users enter them. Unlike direct breaches of company servers, this suggests the data was aggregated from individual users’ devices, likely due to poor password hygiene, such as reusing passwords across multiple platforms.

The Forbes report, updated on June 19, 2025, quotes Vilius Petkauskas of Cybernews, who described the breach as “not just a leak—it’s a blueprint for mass exploitation.” The datasets’ recency and organization make them particularly dangerous, as cybercriminals can use them for automated attacks, including credential stuffing (where stolen credentials are tested across multiple platforms) and targeted phishing campaigns. The inclusion of session cookies and access tokens further amplifies the risk, as these can allow attackers to bypass authentication and directly access accounts.

The breach also highlights persistent issues with password reuse and weak authentication practices. As noted by Darren Guccione, CEO of Keeper Security, in the Forbes article, “This GOAT passwords leak is an apt reminder of just how easy it is for sensitive data to be unintentionally exposed online.” The scale of this breach dwarfs previous incidents, such as the RockYou2024 leak of nearly 10 billion passwords in 2024 and the “Mother of All Breaches” (MOAB) earlier that year, which exposed 26 billion records.

Implications for Users and Crypto Holders

The consequences of this breach are far-reaching. With 16 billion credentials exposed, cybercriminals have a treasure trove of data to exploit for:

• Account Takeovers: Attackers can use stolen credentials to access personal accounts, including email, social media, and banking services.
• Identity Theft: Exposed emails and passwords can be used to impersonate users or steal additional personal information.
• Phishing Attacks: The structured data enables highly targeted phishing campaigns, where attackers pose as legitimate services to trick users into revealing more information.
• Crypto Account Risks: As highlighted by Cointelegraph, the breach poses significant threats to cryptocurrency holders, as many use Google or Apple accounts for crypto wallets or exchanges. Compromised credentials could lead to asset theft.

The Reddit community, particularly on r/CryptoCurrency, expressed alarm, with users noting the urgency of changing passwords for Google and Apple accounts linked to crypto services. However, some skepticism exists, with users questioning the lack of primary source data and suggesting the breach may be a compilation of prior leaks rather than a single event.

How to Protect Yourself

Given the scale of this breach, immediate action is critical to safeguard your accounts. Here are practical steps to protect yourself:

1. Change Your Passwords: Update passwords for all major accounts, especially those on affected platforms like Apple, Google, Facebook, and Telegram. Use strong, unique passwords for each service.
2. Enable Two-Factor Authentication (2FA): Activate 2FA wherever possible, preferably using authenticator apps or hardware keys rather than SMS-based 2FA, which can be intercepted.
3. Use a Password Manager: Tools like Apple’s Passwords app, 1Password, or Dashlane can generate and store unique, complex passwords, reducing the risk of reuse. AppleInsider notes that Apple’s Passwords app can warn users of reused credentials and link directly to websites for password changes.
4. Check for Breaches: Use services like HaveIBeenPwned to check if your email or passwords have been exposed in this or other breaches.
5. Monitor Accounts for Suspicious Activity: Enable alerts for unrecognized login attempts and review account activity regularly.
6. Be Wary of Phishing: Avoid clicking links or providing information in unsolicited emails or messages, as attackers may exploit this breach for targeted phishing.
7. Scan for Malware: Run antivirus software to detect and remove infostealer malware from your devices.

For high-risk individuals, such as public figures or those expecting targeted attacks, Macworld suggests setting up physical security keys (e.g., YubiKey) as an additional layer of protection for Apple accounts.

Critiques and Skepticism

While the breach’s scale is alarming, some online discussions, particularly on Reddit’s r/technology, have questioned the reporting. Users argue that Forbes and Cybernews may be sensationalizing the issue, noting that the data likely represents a compilation of prior leaks rather than a single, coordinated breach. The lack of detailed source data and the reliance on Cybernews’s findings have led to calls for more transparency. Additionally, some platforms, like Snapchat, have stated they found no evidence of a direct breach on their systems, suggesting the data may stem from user-side compromises rather than company server hacks.

Conclusion

The reported 16 billion credential leak is a wake-up call for internet users worldwide. While the exact scope and origins of the breach require further verification, the potential risks—account takeovers, identity theft, and financial loss—are undeniable. By taking proactive steps like updating passwords, enabling 2FA, and using password managers, users can significantly reduce their vulnerability. As cybersecurity threats grow, maintaining robust digital hygiene is more critical than ever.

For more details, check the original Forbes report or Cybernews’s findings. Stay vigilant, and act now to secure your accounts.