Passwords are one of the easiest things for cybercriminals to exploit. If you’re reusing the same one or using a weak one, you’re basically leaving the door wide open. A headline-grabbing leak involving 16 billion credentials has hit the news, and people are scrambling to understand what it actually means. Was it a real breach? Should we be worried? Is it just recycled data? Here’s what went down.

In June 2025, researchers uncovered what’s now being called the largest-ever collection of leaked credentials. Over 16 billion username and password pairs were posted on an underground hacking forum. At first glance, it looked like a mega breach, but the reality is a bit more nuanced.

Most of the data isn’t “new” in the sense of coming from a single fresh attack. Around 85% of it came from info-stealing malware, which silently collects saved passwords from browsers and apps. The remaining 15% came from older breaches like LinkedIn, Dropbox, and others. So, while a chunk of the data has been floating around for a while, much of it is still active and usable. That’s what makes it dangerous.