Cybersecurity experts warn that 16 billion login credentials have been leaked, leaving the personal and financial data of millions of people vulnerable.
Over 16 billion login credentials stolen in personal data breaches this year: How to know if you are impacted and what to do to protect your data
The team at Cyber News, an outlet dedicated to internet security, reported earlier this week that their researchers have been tracking several massive exposed datasets. A total of 30 have been discovered, each of which they claim contains “tens of millions to over 3.5 billion records each.” Altogether, the Cyber News team believes they have identified approximately 16 billion records exposed online, leaving the personal and financial information of millions vulnerable to hacking.
How was this information found?
Researchers at Cyber News monitor breaches and websites where malicious actors share news of attacks to exploit exposed data.
Though often described as “leaks” of sensitive information, the researchers say their findings are far more alarming, calling them a “blueprint for mass exploitation.” The team warns that with billions of login records available to cybercriminals, they now have “unprecedented access to personal credentials that can be used for account takeover, identity theft, and highly targeted phishing.”
Even more concerning is that, in the past, researchers would often see the same login credentials repeated across different databases. In contrast, these recent discoveries contain new data, which the team describes as “weaponizable intelligence at scale.”
What should you do if your data appears in a data breach?
Here are a few tips to follow if you learn your data has been leaked and is at risk:
Check for compromised credentials
Use services like Have I Been Pwned to see if your email or login credentials have been exposed in a breach. This site will allow you to see whether your email address has been linked to any data breaches.
Change your passwords
If you suspect your account has been compromised—or receive confirmation that your credentials have been stolen—reset your password immediately. In some cases, companies may proactively change customer passwords after a breach, as AT&T did following an attack in 2024. It is best practice to use different passwords for your accounts to avoid hackers being able to more easily gain access to other data once they have penetrated one account. If a malicious actor gains access to one, they may try the same credentials elsewhere to access more of your personal and financial information. Consider using a password manager to securely store and manage your passwords across different accounts.
Monitor your accounts
Regularly review your bank statements and credit card reports for unauthorized activity. You might also consider placing a fraud alert or credit freeze to protect your accounts further.
Be wary of phishing attempts
Scammers often take advantage of data breaches. Be cautious of unsolicited emails, calls, or texts claiming to be from companies that report your information has been stolen. Never click on suspicious links or attachments, and never share personal information through these channels. In the United States alone, over 1 billion phishing attempts are made each year.
Get your game on! Whether you’re into NFL touchdowns, NBA buzzer-beaters, world-class soccer goals, or MLB home runs, our app has it all. Dive into live coverage, expert insights, breaking news, exclusive videos, and more – plus, stay updated on the latest in current affairs and entertainment. Download now for all-access coverage, right at your fingertips – anytime, anywhere.