Over 16 Billion Passwords Leaked on Dark Web: Apple, Google, Facebook and Other Services at Risk

A major upheaval has shaken the world of cybersecurity as over 16 billion passwords have been leaked on the dark web, exposing login credentials and sensitive passwords from popular services including Apple, Google, Facebook, GitHub, Telegram, and various government platforms. This massive data leak poses a serious security threat to users worldwide.

According to Forbes, citing cybersecurity news outlet CyberNews, the alarming discovery was made during an investigation led by researcher Vilius Petrikauskas. Their probe uncovered a mysterious web server hosting an unsecured database containing 184 million records.

The researchers reported identifying 30 different datasets, each containing up to 3.5 billion records. These leaked datasets encompass data from social media platforms, VPN login credentials, corporate, and developer services. Since early 2025, these datasets have reportedly been widely exploited by malicious actors.

Petrikauskas stated that the leak has been under surveillance since the beginning of 2025. In total, over 16 billion records have been found across these datasets, ranging from millions to as many as 3.5 billion user records per dataset.

Experts attribute this massive data breach primarily to the InfoStealer malware, a type of malicious software that copies saved usernames and passwords from browsers without user consent and sends them to hacker-controlled servers. The leaked data is organized in such a way that each entry contains a URL, username, and corresponding password—meaning hackers now have an accurate log of who logged into what service and when.

This unprecedented leak underscores the urgent need for users and organizations alike to strengthen cybersecurity measures, change passwords regularly, and enable multi-factor authentication wherever possible.

Photo: Collected from Internet