The first thing to do is stay calm. The second, change your passwords. The third? Read this article and take action to protect your accounts.
You have probably already seen the headlines. People are calling it the largest password leak in history. The news left the world in shock: researchers at Cybernews found 16 billion usernames and passwords publicly available. That is as if there were two leaked credentials for every person on the planet. What does this mean, and how can you protect yourself right now?
What happened and how to know if your credentials are at risk
The Cybernews team has been investigating for months. In just six months, they managed to collect 30 unsecured databases. In total, they add up to 16 billion exposed credentials.
Most of them come from Portuguese-speaking countries (around 3.5 billion). There is also data from Russia (455 million) and another 60 million that could be linked to Telegram.
The structure? Simple: a URL, followed by a username and a password. Nothing else.
The leaked data appears to include accounts from platforms such as Apple, Google, Facebook, Telegram, and GitHub. And the most alarming part: the passwords were leaked in plain text, not encrypted.
Cybernews points out that the data is “fresh.” In other words, it is not part of previously known leaks. The big question remains unanswered: where did these credentials come from, and why do only they have access?
So far, no one has been able to verify that this database exists. Nor is there any way to know whether your credentials are included.
According to the researchers, access may have been obtained through spyware known as stealers. This threat is growing. In fact, password-stealing attacks rose 21% between 2023 and 2024. Cybercriminals do not discriminate: they target ordinary users and businesses alike.
What can you do right now to protect yourself?
We know there is no clear evidence about this leak. Nor do we know who is actually affected. But that does not mean you should sit back and do nothing.
The best thing to do is change your passwords. And do it now.
There are ways to create secure passwords that cybercriminals cannot guess and that you can still remember. If you do not know where to start, read this article, How to create an unforgettable password, and choose the method that works best for you.
Turn phrases you love into secure passwords
A good technique is to use a phrase that inspires you. It can come from a song, a movie, or a special memory.
Then, replace every two or three letters with unique characters. Avoid characters that sit next to each other on the keyboard to make it more secure.
For example: if you like Harry Potter, you could take Wingardium Leviosa. Following the rule, it turns into something like: Wi4ga/di0mL&vi@sa
Easy to remember. Hard to guess.
Key steps to strengthen your digital security
🔒 Use a trusted password manager
It is the safest way to store your passwords. It generates strong passwords, stores them, and fills them in for you across all your devices. You only need to remember one master password. That password protects everything: accounts, banking details, photos, and more. One practical option is Kaspersky Password Manager.
🔐 Turn on two-factor authentication (2FA)
Today, almost every service supports 2FA. Adding this second factor makes your account far harder to hack. With Kaspersky Password Manager you can store and sync the codes, and generate new ones from your phone or computer.
🧹 Delete passwords saved in your browser
Browsers are not safe places to store passwords. Not convinced? In our article on how to store passwords securely, we explain how hackers can steal them in seconds.
📱 Protect your messaging apps
WhatsApp and Telegram can also be at risk. We have a quick guide with steps you can apply today to keep your account from being hijacked.
🗝️ Switch to passkeys if you can
Passkeys are the new way to sign in without passwords. Google, Apple, Microsoft, Meta, and other platforms already use them. If you are not sure how they work, check here. There we explain their advantages, how secure they are, and how to enable them step by step. You can also manage them with Kaspersky Password Manager.
