The digital world has just received a monumental blow. A new leak has put the accounts of billions of people around the planet at risk. We are talking about more than 16 billion exposed passwords, from services as massive as Apple, Google, Facebook, TikTok, LinkedIn, Telegram, and even virtual private networks (VPN). It is, quite simply, the largest and most alarming credential leak ever recorded.

What makes this incident even more worrying is that it is not a compilation of old data, but a collection of newly stolen credentials, many of them never seen in previous leaked databases.

The discovery was made by cybersecurity researchers who found more than 30 files with username and password pairs ripe for exploitation. And while the exact source is difficult to trace, everything points to a large-scale operation using infostealer-type malware, capable of stealing information directly from compromised devices.

How did this unprecedented leak happen?

This new digital disaster began to take shape throughout 2024, when a notable increase in the use of malware specifically designed to steal credentials was detected. These malicious programs infiltrate devices (computers or smartphones), collect information stored in browsers, applications, and authentication systems, and send it to servers controlled by cybercriminals.

Once collected, the credentials were organized into databases that quickly appeared on underground forums and dark web markets. The files are very precisely structured, with URLs, usernames, and passwords in clear text, making them extremely easy to use for automated attacks.

In total, more than 16 billion combinations were found, many of them active accounts, with direct access to services such as iCloud, Gmail, Facebook, Amazon, and banking platforms. There are also government and professional accounts,which raises the threat level even further.

The most shocking thing is that almost 70% of the content in this leak had not been previously reported, meaning it's new data that could be used at any time. And it's likely that many of the affected users don't even know their accounts have been compromised.

What does this attack mean for users?

In simple terms: you're at risk, even if you think you're not. This leak doesn't discriminate. It could have affected anything from an old email you used for online gaming to your main work account, your Facebook profile, or your access to banking services.

The problem is that many people reuse passwords. If any of your credentials appear in these files, and you use that same password on other platforms, the risk multiplies. Attackers can automate logins using bots that test combinations across different services, known as credential stuffing attacks.

In addition, access to your accounts can lead to something worse: identity theft, blackmail, banking fraud, loss of personal data, or even social media impersonation. And if you use those accounts to authenticate to other apps (for example, with Google or Apple login), the damage can escalate quickly.

What can you do to protect yourself?

The good news is that you still have time to act. Cybersecurity experts recommend taking immediate steps to minimize the risks:

It's also a good idea to check if your email has been involved in a breach, using tools such as security managers or identity monitoring services.