A group of Cybernews researchers, led by Vilius Petkauskas, has revealed a leak of 16 billion login credentials obtained through infostealer malware. The investigation, launched in early 2025, identified 30 exposed databases, with records ranging from millions to 3.5 billion each, spanning services such as Google, Apple, Facebook, GitHub, Telegram, and government portals.

This discovery, also reported by Forbes, is described as one of the largest data breaches in history, putting millions of users and organizations at risk.

    "Top 20 leaked datasets by number of records." Source: Cybernews

The data, structured as URLs accompanied by plain text usernames and passwords, reflects the modus operandi of infostealers, malicious programs designed to collect sensitive information from infected devices.

The scale of the breach facilitates attacks such as account takeovers, targeted phishing, and identity fraud. While researchers were unable to determine the exact number of people affected due to possible duplication, the potential impact is immense, considering that 5.5 billion people have internet access. The lack of clarity about the owners of these databases, which were briefly accessible online before being blocked, exacerbates the situation.

Cybernews warns that new similar databases emerge every few weeks, highlighting the prevalence of this type of malware. The cybersecurity magazine also highlights that organizations must strengthen cloud security and adopt zero-trust models to mitigate risks, and that users face the uncertainty of not knowing if their data has been compromised.

To protect themselves, investigators say, users should prioritize unique, strong passwords and change them frequently. Enabling multi-factor authentication and using updated antivirus software can help detect and remove infostealers. Regularly scanning systems for malware and avoiding reusing credentials across multiple platforms are critical measures against breaches of this magnitude.