Massive Infostealer Attack Exposes 16 Billion Apple, Google, Facebook Logins

A record-breaking 16 billion login credentials—including usernames, passwords, emails, URLs, and full login sequences—have been exposed in what cybersecurity experts are calling an unprecedented global data breach.

The leaked data spans major platforms such as Apple, Google, Facebook, Instagram, GitHub, Telegram, Netflix, VPN services, and even government portals. The breach was confirmed by researchers at Cybernews, who described the dataset as a “blueprint for mass exploitation,” warning of severe consequences ranging from phishing attacks and account takeovers to large-scale identity theft.

The breach was discovered through an ongoing investigation that began in January 2025 and consists of 30 distinct datasets, each containing tens of millions to over 3.5 billion unique records. Unlike many previous leaks, this dataset is not a rehash of outdated information.

Cybernews lead researcher Vilius Petkauskas stated that nearly all the credentials are newly harvested and “weaponizable,” presenting fresh, exploitable intelligence for cybercriminals. The only exception is a previously identified database of 184 million records, which surfaced online in May 2025.

Included in the exposed data are credentials for personal and enterprise accounts across major platforms—Apple, Google, Facebook, Snapchat, Instagram, and Netflix—as well as developer logins to GitHub, which could open the door to source code theft and software supply chain attacks.

VPN credentials, financial service logins, and health-related accounts are also affected, raising the stakes for fraud, medical data exposure, and ransomware campaigns. Even government portals from multiple countries were compromised, prompting national security concerns.

The datasets were reportedly stored in misconfigured cloud environments and unsecured Elasticsearch instances, exposing sensitive information in a uniform format: a login URL paired with email addresses, usernames, and passwords. This structure indicates the credentials were likely harvested by infostealer malware—a class of malicious software that scrapes data directly from infected devices, extracting browser-stored passwords, session cookies, tokens, and metadata.

Cybersecurity researchers emphasized that this breach is far more than just a leak. It’s a roadmap for cybercriminal operations on a global scale. With 16 billion exposed credentials, even a 0.1% success rate in credential reuse could lead to tens of millions of account compromises.

Cybercriminals can use the data to launch sophisticated phishing campaigns, execute credential-stuffing attacks on multiple platforms, gain unauthorized access to banking or crypto wallets, and infiltrate corporate networks through stolen enterprise credentials. The inclusion of session cookies and browser metadata also increases the likelihood of bypassing standard security measures, particularly for accounts that lack multi-factor authentication (MFA).

Darren Guccione, CEO of Keeper Security, called the breach a “wake-up call,” highlighting the urgent need for improved cloud security and stronger authentication practices. He stressed that the exposed credentials cover the most widely used online services globally, magnifying the scale and severity of the threat. The breach highlights the risks associated with inadequate cloud configurations and the increasing prevalence of infostealer malware in cyberattacks.

While the exact origins of the datasets remain unclear, experts believe threat actors may have compiled some data, while others could have originated from poorly secured monitoring environments. The uniform formatting and previously unseen content strongly suggest that infostealer malware was used to collect the data actively. Cybernews also reported that new datasets of this nature appear every few weeks, signalling an ongoing and rapidly evolving cybersecurity threat.

Cybersecurity researcher Jeremiah Fowler, who previously uncovered the 184 million-record leak, described these datasets as a “cybercriminal’s dream working list.” Many of the files are stored in plain text without encryption or password protection, making them vulnerable to exploitation upon discovery. This lack of basic security safeguards is contributing to the increasing frequency of credential-based attacks.

Posts have emphasized the importance of resetting passwords, enabling multi-factor authentication (MFA), and using password managers to mitigate the risks of account compromise. One user wrote, “Expect a wave of takeovers—especially for accounts with recycled passwords or no 2FA.” Others warned crypto users about potential wallet theft via leaked cookies or recovery data.

Cybersecurity experts recommend immediate steps for mitigation: change passwords—especially for high-value accounts like email, social media, banking, and crypto platforms—use unique, strong passwords via a password manager, enable multi-factor authentication using apps or hardware keys, check for exposure through platforms like Have I Been Pwned, scan devices for malware, and avoid clicking suspicious links.

In cases involving financial accounts, freezing credit and monitoring bank activity is also advised. Where supported, adopting passkeys (available through Apple and Google) offers an additional layer of phishing-resistant security.

As of June 19, 2025, major companies named in the breach—including Apple, Google, Meta, and others—have not issued public statements specifically addressing the leak. However, some tech firms, such as Microsoft and Cloudflare, have recently participated in global takedowns of infostealer malware like Lumma Stealer, signalling an active response to the growing threat.

Governments may soon be forced to respond more aggressively, especially with public-sector credentials included in the leak. Regulatory pressure may increase for mandatory multi-factor authentication (MFA), stricter cloud storage protocols, and updated cybersecurity laws that target both the private and public sectors.

The exposure of 16 billion login credentials marks one of the largest and most dangerous data breaches in history. It poses a severe threat to digital privacy, financial security, and national defense. As new infostealer-driven breaches continue to surface, experts urge a complete reassessment of how digital identities are stored, protected, and authenticated.