Cybersecurity experts are advising internet users to change their passwords and enhance their digital security after researchers at Cybernews uncovered a massive cache of login credentials — totalling 16 billion records — briefly exposed online.
According to the investigation, the data was compiled from 30 datasets containing credentials obtained through malicious software known as “infostealers” as well as older data breach leaks. While some of the records may be duplicates, the scale of the exposure highlights the vast amount of personal information potentially accessible to cybercriminals.
Bob Diachenko, the Ukrainian cybersecurity specialist behind the discovery, said the datasets were poorly secured on remote servers, making them temporarily accessible before being removed. Diachenko confirmed he had downloaded the data and is working to notify affected individuals and organisations.
“This is a staggering amount of data and it will take time to fully assess,” he said, noting that the exposed credentials included login URLs for major platforms such as Apple, Facebook, and Google. However, there is no evidence of a direct breach involving those companies.
Google responded to the report, clarifying that the data was not the result of any security failure on its part. The tech giant encouraged users to protect their accounts by using tools like Google Password Manager and enabling multifactor authentication (MFA).
Prime9jaOnline gathered that approximately 85% of the data came from infostealer malware, while the remaining 15% was linked to past leaks, including one involving LinkedIn.
Security analysts say the findings reinforce the importance of strong cybersecurity hygiene, including regular password updates, the use of password managers, and two-factor or multifactor authentication. Emerging solutions like passkeys — a password-free login option supported by companies like Google and Meta — are also being encouraged as safer alternatives.
Peter Mackenzie, Director of Incident Response at cybersecurity firm Sophos, said the leak serves as a stark reminder of how much personal data remains vulnerable.
“There’s no new breach threat here, but it highlights the depth of data cybercriminals already have access to,” he said. “Users must take proactive steps to safeguard their accounts.”
Toby Lewis, Global Head of Threat Analysis at Darktrace, added that while the full extent of the leak is still under review, infostealers remain a significant threat. These tools collect data such as cookies and browser metadata rather than directly breaching accounts.
“If you use password managers, enable MFA, and monitor for unusual logins, there’s little cause for alarm — but it’s always wise to stay vigilant,” Lewis said.
Experts described the exposed records as a “blueprint for mass exploitation,” warning that attackers could use them for account takeovers, identity theft, and targeted phishing. Fortunately, researchers believe the brief window of exposure may have prevented wider access to the data by malicious actors.
Alan Woodward, a cybersecurity professor at the University of Surrey, called the incident a timely reminder for digital "spring cleaning."
“Everything eventually gets compromised,” he said. “That’s why zero-trust security models are more critical than ever.”