Over 16 billion credentials leaked: What really happened?

Recently, headlines were ablaze with claims of the “largest data breach in history” after 16 billion credentials were leaked online. But let’s set the record straight: this isn’t a single breach, nor is it entirely new data. It’s part of a growing trend that cybersecurity teams have been battling for years and the threat is more widespread than most realize.

Not a Breach, A Compilation

The leak, first reported by Cybernews, is not the result of one massive hack. Instead, it’s a combo list — a compilation of previously leaked credentials, primarily harvested from info stealer malware infections and older breaches.

This method of compiling massive troves of stolen data isn’t new. In fact, iZOOlogic has recovered over 40 billion compromised records over just the past six months alone from similar sources — stealer logs and combo lists. This growing figure reflects just how rampant and organized this data economy has become.

The Role of Info Stealers

Info stealers are a category of malware designed to quietly infect devices and extract valuable data, including:

• Usernames and passwords
• Email accounts
• Crypto wallets
• Browser autofill information
• System and network metadata

Malware like Redline, Vidar, and RaccoonStealer are sold as plug-and-play kits to cybercriminals, enabling widespread infection campaigns. Once stolen, the data is compiled into logs and resold, traded, or leaked on dark web forums.

From “Collection #1” to 2025

Back in 2019, the infamous “Collection #1” leak exposed around 2.7 billion credentials, largely cobbled together from past breaches. That list was widely used in credential stuffing attacks, where attackers use known credentials to attempt logins across multiple platforms, hoping users reused passwords.

Fast forward to 2025, and we’re now seeing combo lists more than six times that size — a sign that the underground data trade is evolving rapidly and becoming more dangerous.

Who’s Behind It?

While attribution is still unclear, evidence suggests this dataset may have been curated from various groups of threat actors, actively collecting logs from stealer malware infections and publicly available breach dumps.

These actors typically profit by:

• Selling the data on underground markets
• Using it for credential stuffing or account takeovers
• Offering access to “fresh logs” on Telegram channels and forums

Why It Matters

You may think, “This isn’t new, so I’m safe.” But that’s not necessarily true. Many users still reuse passwords across platforms — meaning even old credentials can still provide access to live accounts.

What You Should Do Immediately

1. Check if you’re affected
   Use a reputable data breach checker to see if your email or passwords have been exposed in known leaks.
2. Change your passwords
   Create strong, unique passwords for every account, especially for financial, email, and social media platforms. Avoid reusing old passwords.
3. Enable Two-Factor Authentication (2FA)
   Add an extra layer of security to your accounts. Even if someone has your password, they won’t be able to log in without the second factor.
4. Use a password manager
   Store and manage your passwords securely. A good password manager helps you generate and remember strong, unique passwords for every site.
5. Monitor for suspicious activity
   Watch for login alerts, unexpected password reset emails, or unfamiliar activity on any of your accounts.

The leak of over 16 billion credentials may sound shocking, but for those of us tracking underground cybercrime activity, it’s simply the latest confirmation of a troubling trend. At iZOOlogic, we’ve observed a relentless surge in data theft , primarily driven by the widespread use of infostealer malware and the growing circulation of combo lists across the dark web and underground channels.

As the cybercrime ecosystem becomes more organized and data theft more commoditized, basic security practices are no longer just best practices, they’re non-negotiable necessities.