
Nearly 16 billion passwords for Apple, Facebook, Google and other online services have been stolen, researchers at cybersecurity website Cybernews have revealed. It is the largest breach of credentials ever discovered. The stolen passwords include those linked to government service accounts.
The data leak exposed over 16 billion credentials and passwords. According to Forbes (which cooperated with the investigation), Google has invited two billion users to change their passwords. In the United States, the FBI has warned citizens against suspicious links sent via SMS.
The largest data breach ever discovered
The researchers identified “30 exposed data sets, containing from tens of millions to over 3.5 billion records each,” it said. All but one had not been previously published, meaning the data is new. It is likely that Italian accounts were also involved, but there has been no official confirmation from the companies at this time.
According to the analyses so far (and as confirmed by experts interviewed by Italian Tech), it is very likely that this leak of credentials comes mainly from a cluster of 'infostealers', that is, malware designed to steal sensitive information from infected devices. Among these: usernames and passwords stored in browsers, session cookies (which enable automatic login to sites), bank or payment card details stored, local files and even screenshots.
Expert: "Enable two-factor authentication"
“The most likely hypothesis at the moment is that it is a simple collection of passwords that have emerged in previous data breaches,” explains Matteo Flora, a cybersecurity expert, to Italian Tech. “However, even if it is not a new data theft, it is a very good moment to review your digital security measures: activate two-factor authentication, perhaps switching from phone number verification to a more secure authentication app or, even better, a Passkey,” he adds. “It is one of the only really effective defenses in a scenario where databases of stolen credentials are becoming increasingly large and easy to find.”
Cybernews had previously revealed on July 4, 2024, the exposure of about 10 billion stolen passwords, published on a forum by a user. The news was then confirmed. But this time the situation seems a little different.
“This is not just a password leak, but a large-scale exploitation project,” the researchers told Forbes. “This data is a fertile ground for phishing attacks and account theft. We’re not just talking about old breaches being recycled, but new, potentially dangerous, and immediately exploitable information.”
What passwords, what data?
Most of this data was in URL format, followed by a login and password, which allowed direct access to almost every online service imaginable: from Apple, Facebook, and Google, to GitHub, Telegram, and various government portals.
Despite the seriousness of the discovery, the researchers explain that the data remained public for a relatively short time. A period long enough for it to fall into the hands of malicious actors, but too short to understand who was its real controller./La Repubblica