News spread early Fridaythat a record-breaking data breach exposed 16 billion passwords to the world,Dead Again including user credentials for the likes of Facebook, Google, Apple, and tons of other places. Some commentators were quick to call it the largest password leak in history, and in terms of raw records exposed, that’s mostly, technically true. However, these records did notcome from a single breach — or even a new breach. Instead, they came from many smaller ones.
Data breaches are an unfortunate reality in the digital age, and some of the breaches can be quite large. However, not every release of stolen data is the direct result of a recent cybersecurity breach. As Mashable recently reported in our countdown of the top cybersecurity breaches of 2025, hackers will often compile information from multiple prior hacks and combine them into one massive file. This is becoming a trend in the darker corners of the internet. The end result is more of a “greatest hits” rather than a new, noteworthy hack.
Such is the case here. Per Bleeping Computer, the information contained in the 16 billion records was most likely compiled from a host of prior hacks, compiled, and then released as a single set of data. It was likely circulating for some time before being compiled, and likely came from a combination of breaches, hacks, phishing scams, and malware.
This is backed up by a tweetfrom vx-underground, an educational website that specializes in malware and cybersecurity. “Someone took a bunch of existing leaks, threw it all together, and slapped a NEW stick [sic] on it.”
This Tweet is currently unavailable. It might be loading or has been removed.
However, the existence of all this data in one spot is still rather damaging, as cybercriminals now have access to all of this data in a single spot, potentially making it much easier to concoct more effective phishing scams or engage in identity theft.
The largest single-point data breach in history is still Yahoo’s 2016 breach, when hackers stole data about all three billion of the website’s users.
Mashable is live at VidCon 2025:Check out our VidCon coveragewith your favorite content creators now.
With so many records in one spot — even if some of them are legacy data that is no longer relevant — it’s still probably a good idea to take an audit of your online services to make sure you’re protected. A good place to start is Have I Been Pwned, a website dedicated to showing data breaches. Simply go there, enter your email address(es), and the site will show you which credentials have been exposed to the public.
We recommend changing those credentials immediately if you haven’t already, and using a strong password when you do so, as they are more difficult to crack. After that, you’ll want to enable multi-factor authenticationon every account you possibly can, as the added layer helps keep criminals from stealing your life if they obtain your password. That should be the bare minimum, but there are plenty of other steps you can taketo keep yourself safe online as well.
Have a story to share about a scam or security breach that impacted you? Tell us about it. Email [email protected]with the subject line "Safety Net" or use this form.Someone from Mashable will get in touch.
Topics Cybersecurity
These 36 beaches should be avoided (again) because of all the human pooNigel Farage gets pelted with an egg in spectacular direct hitSouth Korea to impose stricter phone battery safety regulationsFans relentlessly booed NFL commissioner Roger Goodell after the Super BowlCNN and Kellyanne Conway's Twitter feud just escalated hilariouslyHere's why a 30Concerned kid writes vet adorable email after her cat drank strawberry milkYour favorite Warner Bros. shows are getting the 'Lego Batman' treatmentThis space capsule looks so real that a NASA scientist reported itEarly newspaper editions could not keep up with that legendary Super Bowl endingLady Gaga jumping off the Super Bowl roof is America's new favorite memeThis DIY tripleThanks to the Pats Super Bowl win, we can finally stop talking about DeflategateGoogle teams up with H&M to make dresses based on your personal dataYou can finally have a Cheeto that looks like Harambe ... for $99,999UK mosques open up to visitors for food, tea, and a chance to talkLady Gaga jumping off the Super Bowl roof is America's new favorite memeMan and his adult son maintain 7 sex dolls that they care for like familyEarly newspaper editions could not keep up with that legendary Super Bowl endingApple's fight with big banks is getting even nastier, and it was already nasty Channel badass female characters with these DIY Halloween costumes Most Antivirus apps on Google Play suck at detecting malware 'The Boy Band Con' struggles to hide hatred for Lou Pearlman: Review 'Harry Potter' birthday party is way more intricate than you'd expect Police urge people to stop sharing that Christchurch shooter video online Tesla reveals the Model Y, its new mid Photos of magical night buses could be proof of a parallel wizarding universe 'Great British Bake Off' finale is tonight, and British Twitter is going to explode It's not your imagination: This Facebook outage is massive Wax seal letter videos will bring you back to a simpler time Flight on Southwest or American? Make sure it wasn't on a Boeing 737 Max. Apple announces WWDC 18 dates: June 3 Inside Tesla's Model Y unveiling event with Elon Musk Google's Lookout app helps the blind explore their surroundings Someone created a giant Donald Trump portrait on a cornfield in Italy Apple Music Launches on Amazon Fire TV Trump grounds Boeing 737 Max planes after fatal crashes Slow TV finds life online with Facebook Live and Periscope Android Q will let you share Wi Eliminating toxic masculinity should be on every parent's to