There has been a gigantic data breach – thunders the CyberNews service together with “Forbes”. The breach, caused by malware of the infostealer type, affected accounts on platforms such as Google, Apple, Facebook and Telegram.
The announcements, which have so far been mainly in the American media, have mentioned 16 billion data records from Google, Apple and Facebook. That's twice as many as the people on Earth… Are these really passwords and should we change them?
Cybernews reports: “Researchers say most of the data in the exposed datasets is a mix of information from malware stealers, credential sets, and repackaged leaks. (…) There was no way to effectively compare data across the different datasets, but it's safe to say there are certainly overlapping records. In other words, it's impossible to determine how many people or accounts were actually exposed.”
See alsoHow artificial intelligence will affect the work of accountants
The Niebezpiecznik.pl website reassures us that it is not about 16 billion passwords, but about “a collection of data from computers infected with infostealers (malware that steals passwords, e.g. those entered into the browser during login), not a leak from this or that website”. Infostealer logs are quite heavily exploited by cybercriminals' scripts – he adds. Therefore, “if you were a victim of an infostealer, you would probably already know about it”.
This data has been compiled over many years, so it's thousands of irrelevant login points, the service explains. This includes login details for social media and many popular services.
No, 16 billion passwords ❌ NOT ❌ were leaked from Apple, Facebook, and Google, as some people panic who did not read the article from today's Forbes very carefully.
It is a collection of data from computers of people infected with infostealers (malware…
— Niebezpiecznik (@niebezpiecznik) June 19, 2025
This means that, while it is possible that there are new records among the disclosed data, everything indicates that most of these 16 billion entries come from old leaks.
“The inclusion of both old and recent data theft logs – often with tokens, cookies, and metadata – makes this data particularly dangerous to those lacking multi-factor authentication,” the Cybernews team found.
Google has informed potentially vulnerable users to change their passwords. And, as cybersecurity experts explain, if we had a weak social password and no two-factor login method, now is the time to fix it and install antivirus programs if we don't have them.
prepared by KWS
