If you have not checked your credentials lately, now is the time. A staggering 1.3 billion unique passwords and 2 billion unique email addresses surfaced online. This event is one of the largest exposures of stolen logins we have seen.
This is not the result of one major breach. Instead, Synthient, a threat intelligence firm, searched the open and dark web for leaked credentials. You may remember the company from its earlier discovery of 183 million exposed email accounts. This time, the scale is far larger.
Where this huge trove came from
Most of the data comes from credential stuffing lists. Criminals pull these lists from old breaches and use them in new attacks. Synthient went further. Its founder, Benjamin Brundage, gathered stolen logins from hundreds of hidden sources across the web.
The data includes old passwords from past breaches and fresh passwords stolen by info-stealing malware on infected devices. Synthient partnered with security researcher Troy Hunt, who runs Have I Been Pwned. He verified the dataset and confirmed that it contains new exposures.
To test the data, Hunt started with one of his old email addresses. He already knew it had been added to past credential stuffing lists. When he found it in the new trove, he reached out to trusted Have I Been Pwned users to confirm the findings. Some had never appeared in breaches before, which proved that this leak includes new stolen logins.
How to check if your passwords were stolen
To see if your email was affected, visit Have I Been Pwned. It is the first and official source for this newly added dataset.
- Enter your email address to find out if your information appears in the leak.
- When done, come back here for Step 1 below.
How to protect yourself after this massive credential leak
These simple actions strengthen your accounts fast and help you stay ahead of criminals who rely on stolen passwords.
1) Change any exposed passwords immediately
Do not leave a known leaked password in place. Change it right away on every site where you used it. Create a new login that is strong, unique and not similar to your old one. This step cuts off criminals who already have your stolen credentials.
2) Stop reusing passwords across sites
Avoid reusing passwords across sites. Once hackers get a working email and password pair, they try it on other services. This attack method, called credential stuffing, still succeeds because many people recycle the same login. One stolen password should not unlock every account you own.
Watch the latest episode of The CyberGuy Report.
Missed this event? Sign up via the registration form and see our live recording.
See Kurt’s latest Amazon picks for useful gadgets, smart home upgrades and everyday tech worth grabbing while the deals last.
3) Use a strong password manager
A strong password manager can generate new secure logins for your accounts. It creates long, complex passwords that you do not have to memorize. It also stores them safely so you can sign in quickly without taking risky shortcuts. Many password managers also scan for breaches to see if your current passwords have been exposed.
Next, see if your email has been exposed in past breaches. Our #1 pick, NordPass, includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.
- Unlimited password storage
- Secure sharing
- Password health reports
- Auto-fill and emergency access
- Data breach monitoring to alert you if your credentials have been exposed
- A Security Dashboard with tools like the Data Breach Scanner and Password Health Checker to identify weak, reused, or compromised passwords
CyberGuy Exclusive Deal: Save 52% now with CyberGuy’s exclusive NordPass offer – Get 1 extra month FREE with a 2-year plan. Try 30 days risk-free for only $1.43 per month!
4) Turn on Two Factor Authentication
Even the strongest password can be exposed. Two-factor authentication adds a second step when you log in. You may enter a code from an authenticator app or tap a physical security key. This extra layer blocks attackers who try to access your account with stolen passwords.
5) Protect your devices from malware and install strong antivirus software
Hackers often steal passwords by infecting your devices. Info-stealing malware hides inside phishing emails and fake downloads. Once installed, it pulls passwords straight from your browser and apps. Protect your phones and computers with strong antivirus software. It can detect and block info-stealing malware before it drains your accounts. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.
- Strong real-time protection against viruses, malware, ransomware and hacking attempts
- AI-powered scam protection to help identify suspicious emails, texts and websites
- Built-in password manager to securely store and manage logins
- 2 GB PC cloud backup to help protect important files from ransomware or hardware failure
- Smart firewall and phishing protection
- Protects 1, 3 or 5 devices
- Available for Windows, macOS, Android and iOS
- Includes real-time threat protection, smart firewall and phishing protection to guard against online attacks
6) Consider switching to passkeys when possible
If you want better protection, start using passkeys on services that support them. Passkeys use cryptographic keys instead of text passwords. Criminals cannot guess or reuse them. They also stop many phishing attacks because they only work on trusted sites. Think of passkeys as a secure digital lock for your most important accounts.
7) Use a data removal service
Data brokers collect and sell your personal details, which criminals can combine with stolen passwords. A trusted data removal service can help find and remove your information from people-search sites. Reducing your exposed data makes it harder for attackers to target you with convincing scams and account takeovers.
While no service can guarantee total removal, they drastically reduce your digital footprint, making it harder for scammers to cross-reference leaked credentials with public data to impersonate or target you. These services monitor and automatically remove your personal info over time, which gives me peace of mind in today’s threat landscape.
Exclusive Deal for CyberGuy Readers (60% off): Incogni offers a 30-day, money-back guarantee and applies a special CyberGuy discount to all annual plans, for as low as $6.39/month for one person (billed annually) or $13.19/month for your family (up to 5 people) on their annual plan.
I strongly recommend the family plan. Here's why: the scam that starts with a Google search of your name almost always ends with a call to you, your elderly parent or a text to your adult child. Protecting yourself without protecting the people around you is half a solution. At $2.64 per person per month, the family plan covers up to five people, and the people most likely to be the final target are often the ones who'd never think to protect themselves.
Get Incogni and remove your info
8) Review your security often
Security is not a one-time task. Check your passwords on a regular schedule and update older logins before they become a problem. Review which accounts have Two Factor Authentication turned on and add it where you can. By staying proactive, you stay one step ahead of hackers and limit the damage from future leaks.
Related Links:
- Louvre heist exposes weak password problem
- 183 million email passwords leaked: Check yours now
- Best Password Managers expert reviewed 2025
Kurt’s key takeaways
Massive leaks like this one highlight how fragile digital security can be. Even when you follow best practices, your information can still land in criminal hands through old breaches, malware or third-party exposures. Taking a proactive approach puts you in a stronger position. Regular checks, secure passwords and strong authentication give you real protection.
With billions of stolen passwords floating around, do you feel ready to check your own and tighten your account security today? Let us know in the comments below.
FOR MORE OF MY TECH TIPS & SECURITY ALERTS, SUBSCRIBE TO MY FREE CYBERGUY REPORT NEWSLETTER HERE
Copyright 2025 CyberGuy.com. All rights reserved. CyberGuy.com articles and content may contain affiliate links that earn a commission when purchases are made.
🎙 Now Streaming: My New Podcast: The CyberGuy Report
Kurt’s Top Deals
Deals move fast and inventory can be limited, so don’t wait too long.
| 🔥 Editor’s pick  Summer entertaining Ninja SLUSHi Machine (26% off) Frozen drinks and slushies at home in minutes. | |
| 💰 Top deal  Outdoor essential TYPEC Solar Bug Zapper (36% off) Solar-powered bug zappers for patios and camping. |
1 comment
thanks for this info much appreciated!