In June 2025, headlines reported an unprecedented leak of more than 16 billion credentials, apparently affecting Google, Facebook and others. The claim originated with Cybernews on 18 June, describing what might be the largest credential compilation in history.
Our threat intelligence team investigated. What we found is worth reporting precisely because it is less dramatic than the headline — and, in one specific way, more concerning.
What an infostealer actually is
Understanding this leak requires understanding where the data comes from. An infostealer is malware built to extract sensitive data from an infected device:
- Login credentials
- Passwords saved in browsers
- Cookies and session tokens
- Cryptocurrency wallet details
- Autofill data — names, addresses, phone numbers
The resulting logs are dumped on the dark web and in underground forums, where they are used for credential stuffing, identity theft and account takeover. This is a continuous industry, not an event.
What we found
The "16 billion" figure appears to describe a collection of historical infostealer logs rather than a single recent breach. Specifically:
- The dataset was not being actively sold or distributed on major dark web marketplaces.
- No prominent threat actor claimed responsibility or ownership.
- Samples circulating online were frequently reposts of older leaks, tied to well-known malware families including RedLine, Raccoon Stealer and Vidar.
That said, the volume and structure of the dataset indicate it had been normalised and collated — most likely by data brokers — into structured formats pairing email and password with login metadata. Someone had done real work to make it usable.
No single company was breached. Millions of individual machines were, one at a time, over years — and somebody tidied the results into a database.
Why it still matters
Even if the headline number is exaggerated or repackaged, the underlying threat is entirely real:
- Infostealer logs reach the dark web daily, exposing credentials across every industry.
- Those logs contain personal data, corporate email addresses, session cookies and other sensitive artefacts.
- The data is resold, traded and weaponised for phishing, financial fraud and corporate intrusion.
The session cookies deserve particular attention. A stolen password can be changed. A stolen session token is already authenticated — it has passed MFA, and it keeps working until that session is explicitly revoked. Most organisations reset the password and consider the matter closed.
And one reused email and password pair is enough to turn a personal compromise into a corporate one.
What to do
Immediately
- Change reused passwords. Reuse is the mechanism that turns someone else's breach into your incident.
- Use a password manager to generate and store unique credentials. This is the only realistic way to have a different password everywhere.
- Enable multi-factor authentication using an authenticator app rather than SMS.
Ongoing
- Scan endpoints for infostealer infections — the log had to come from somewhere, and if it was one of your machines the problem is still there.
- Educate users about pirated software, suspicious downloads and email attachments, which remain the primary infection routes.
- Monitor for unusual login patterns and review authentication logs for unfamiliar devices and addresses.
- Revoke suspicious sessions and tokens, not just passwords.
- Apply patches promptly across all systems.
Know what is already out there
Credentials belonging to your organisation are almost certainly in one of these compilations somewhere. Continuous dark web monitoring turns that from an assumption into a list you can act on — which account, which credential, and whether it is still valid.
The wider point
Stories like this create a specific problem: a number so large it becomes abstract. Sixteen billion is not a quantity anyone can act on, and the natural response to an unactionable number is to do nothing.
The useful framing is smaller. Somewhere in that pile are credentials belonging to your people, harvested from machines you may not control, in compilations that will be re-traded for years. That is not a headline event to react to. It is a background condition to design around — with unique passwords, phishing-resistant MFA, session revocation that actually happens, and somebody watching for the credentials that surface.