16 billion login credentials briefly exposed in massive leak, report

30 separate datasets exposed on remote servers

Cybersecurity researchers urge users to change passwords and enable multi-factor authentication as malicious actors will have exploited a briefly exposed cache of login credentials for major platforms.

Cybersecurity researchers have warned that more than 16 billion login credentials were briefly accessible to cybercriminals due to a cache of datasets exposed online.

The records, containing email addresses, passwords, and potentially session cookies, could be used to access accounts on platforms including Facebook, Google, Apple, Telegram, and others.

The discovery was made by Cybernews, an online technology publication, in collaboration with Ukrainian cybersecurity researcher Bob Diachenko.

The data troves reportedly originated from infostealers, a type of malicious software that secretly harvests sensitive information from infected systems, and historical breaches, including the LinkedIn leak.

Though no single, centralised breach was reported at tech giants like Meta or Google, the login credentials found in the exposed data included access points to services operated by them.

Google told The Guardian the data did not stem from its own breach and recommended users adopt strong password hygiene and security tools such as Google Password Manager.

What was found

Cybernews said they uncovered 30 separate datasets, briefly exposed on misconfigured remote servers.

The sizes varied dramatically, from 16 million to over 3.5 billion records, the largest likely targeting Portuguese-speaking users.

In total, the leak consisted of around 16 billion login records, with a high degree of repetition and overlaps.

One dataset named after Telegram included more than 60 million credentials. Another, linked to the Russian Federation, held over 455 million records. Most records followed a uniform structure: URL, then login name, then password, a hallmark of infostealer malware.

Some of the data was generically labelled, such as "logins" or "credentials," limiting the researchers' ability to determine the exact source or scope of some files.

Diachenko, who was able to download and examine the exposed files, confirmed they included a mixture of current and historical data, much of it sourced from infostealer logs containing authentication tokens, cookies, and metadata.

Diachenko estimates the data comprises approximately 85% infostealer logs and 15% old breach data. He said he would begin contacting affected individuals and organisations but admitted, "it will take some time" as it is "an enormous amount of data."

While cybersecurity professionals said many of these records may already have circulated in underground forums, the scale and structure of this dump make it particularly concerning.

Peter Mackenzie, Director of Incident Response at cybersecurity firm Sophos, called the leak a wake-up call: "While you'd be right to be startled at the huge volume of data exposed, it's important to note that there is no new threat here: this data will have already likely have been in circulation."

"What we are understanding is the depth of information available to cybercriminals. It is an important reminder to everyone to take proactive steps to update passwords, use a password manager and employ multifactor authentication to avoid credential issues in the future," he added.

Cybernews described the findings as a "blueprint for mass exploitation," which could facilitate account takeovers, identity theft, and precision phishing attacks.

It is not clear who uploaded or controlled the exposed data.

Earlier this month researchers discovered a 631GB database left exposed to the open internet, containing around 4 billion records on Chinese citizens.