In what appears to be the biggest data breach, an estimated 16 billion passwords linked to Google, Facebook, Apple, and other major digital platforms were reportedly leaked online.
The breach came to light amid mounting reports of an unprotected online database containing 184 million records.
However, new research indicates this was only a fraction of the total exposure. Cybersecurity investigators have since identified 30 distinct datasets, each containing up to 3.5 billion records, uncovered since early 2025. These datasets include credentials for social media platforms, VPN services, corporate accounts, and developer tools.
“This is more than a leak—it’s a comprehensive toolkit for cybercriminal activity,” researchers warned. “These aren’t outdated credentials being recycled. This is recent, actionable intelligence on a massive scale.”
Experts fear the leaked data could be weaponized for large-scale phishing campaigns, unauthorized account access, and business email compromise (BEC) schemes, posing a critical threat to both individuals and organizations.