16 billion leaked logins: passwords alone are finished
The headline number is huge and partly recycled from older leaks. The practical message for every business is the same: assume your passwords are known, and add a second lock.
By the Xuru Technologies team · 21 June 2025
Key takeaways
- In June 2025 Cybernews researchers reported finding datasets totalling about 16 billion login credentials.
- Much of the data likely came from info-stealing malware and earlier leaks, with overlaps.
- Stolen credentials are one of the most common ways into business accounts.
- 2-step verification, passkeys and a password manager block most of these attacks.
Most account takeovers don't involve clever hacking. Someone simply logs in with a password that was stolen somewhere else.
What happened
ABC News and Khaleej Times reported the researchers' findings. Security experts noted the collection was largely an aggregation rather than a single new breach, but still useful to criminals.
What it means for businesses
- Reused passwords are the weak link. One leak can open many accounts.
- Email is the master key. Whoever controls it can reset almost everything else.
- Website admin logins are targets. Hijacked sites are used for spam, scams and malware.
- Passkeys resist phishing because there's no password to steal.
Lock it down this week
| Account | Action |
|---|---|
| Business email | Turn on 2-step verification or passkeys for every user |
| Website admin | 2-step login, unique passwords, remove old users |
| Domain and hosting | 2-step login and registrar lock |
| Social and Google profile | 2-step login and at least two trusted admins |
| Team | A password manager for shared logins |
See our account lockout prevention checklist.
Frequently asked questions
Was this a single new breach?
Researchers and experts indicated it was mostly a compilation of credentials from malware logs and earlier leaks, though some data may have been new.
What is a passkey?
A sign-in method using a cryptographic key stored on your device, unlocked with your fingerprint, face or PIN, which can't be phished like a password.
Should I change all my passwords?
Change reused or weak passwords, especially for email and admin accounts, and turn on 2-step verification everywhere it's offered.
Close the door stolen passwords open.
We audit and secure your website, domain, email and social accounts with 2-step logins and proper admin access.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed
Leave a Reply