Data Breach Alert: 16 Billion Credentials at Risk Technology

[Jason]

A significant cybersecurity event has just made headlines - over 16 billion login credentials have been exposed in what experts are calling one of the largest data breaches in history.

What Happened?
According to a report from Cybernews, data from more than 30 different databases has been leaked. The breach includes login credentials for major services like Apple, Google, Facebook, Gmail, Telegram, GitHub, and even government and corporate platforms. Some individual datasets contain as many as 3.5 billion usernames and passwords.

The leak is believed to have originated from a mix of recent infostealer malware attacks and older breach data. Essentially, malware designed to silently capture login credentials has compiled a massive pool of sensitive information, much of it now publicly circulating among hackers.

What Was Exposed?

• Usernames
• Passwords
• Login URLs
• Possibly associated metadata

The data is thought to span everything from social media and messaging apps to VPNs and developer tools, meaning virtually any online account could be affected.

What Can You Do Right Now?

1. Check if you've been exposed
   Visit Have I Been Pwned and enter your email address. You can also check if your passwords have been compromised via their Pwned Passwords tool.
2. Enable Two-Factor Authentication (2FA)
   This is one of the strongest defences you can have. If a hacker tries to log in with your stolen credentials, they'll still need a second form of verification.
3. Change Your Passwords
   Especially for any accounts where you reuse passwords (which we all know we shouldn't do!). Use a strong, unique password for each service, and consider a password manager if you haven't already.
4. Stay Informed & Be Proactive
   Enable breach alerts, audit your digital footprint, and remove old or unused accounts. Vigilance is key.

Discussion Points:

• Have you checked your credentials yet? Were any of your accounts compromised?
• Do you use 2FA across your accounts? If not, what's holding you back?
• What password manager (if any) do you use, and would you recommend it?
• How often do you audit or update your online security practices?
• Do you think platforms are doing enough to protect user data?

Let's help each other stay informed and safe. If you need help with password tools, setting up 2FA, or checking your exposure status, feel free to ask here.

 

[Jason]

Protect Yourself in 5 Steps

Change Your Passwords

• Especially for email, banking, and reused credentials
• Use long, complex passwords (12+ characters)

Enable Two-Factor Authentication (2FA)

• Use an authenticator app or physical key where possible
• Avoid SMS-only if possible

Check If You're Compromised

• Visit Have I Been Pwned: Check if your email address has been exposed in a data breach
• Search your email and passwords
• Set up breach alerts

Audit Your Accounts

• Delete old/unused accounts
• Update weak or duplicate passwords

Stay Informed

• Follow reliable cybersecurity news sources
• Don't click suspicious links or email attachments

Important Tip: Even if your email isn't listed in Have I Been Pwned, that doesn't mean you're in the clear. Some of the leaked data hasn't been fully indexed yet, and new leaks are still emerging. If you use the same password across platforms, that could still make you vulnerable via "credential stuffing."

 

[Tom]

I found two of my emails in breaches from last year, but I had no idea they'd resurface in something this big. I've changed my Gmail and Apple passwords already. I've been reluctant to do so but I'm now setting up 2FA.

 

[Tom]

What is the best authenticator app for Android?

Actually, better posting generally for all platforms.

 

[Jason]

2FA Authenticator App Comparison Table

App	Backup & Sync	Open Source	Push Auth	Biometric Lock	Cloud-Based	Best For
Authy	Encrypted cloud backup					Cross-device sync & backups
Microsoft Authenticator	via Microsoft Account					Microsoft/Office users
Google Authenticator	(now supports cloud)				(opt-in)	Simplicity, Google ecosystem
1Password (with TOTP)	In password vault					All-in-one password + 2FA
Bitwarden (with TOTP)	In secure vault					Secure open-source integration
Duo Mobile						Enterprise and institutions
Aegis Authenticator	Encrypted local file					Privacy-first Android users
Raivo OTP	iCloud optional				(iCloud)	Open-source iOS solution
FreeOTP						Lightweight, privacy-focused
andOTP (archived)	Encrypted backup					Legacy users (use Aegis instead)

 

[Jason]

Tom. Personally, I use the Microsoft Authenticator.

 

[Jason]

Official Links for 2FA Authenticator Apps

App	Official Website	Google Play	App Store (iOS)
Authy	authy.com	Google Play	App Store
Microsoft Authenticator	microsoft.com	Google Play	App Store
Google Authenticator	Google Support	Google Play	App Store
1Password	1password.com	Google Play	App Store
Bitwarden	bitwarden.com	Google Play	App Store
Duo Mobile	duo.com	Google Play	App Store
Aegis Authenticator	GitHub - Aegis	Google Play / F-Droid	—
Raivo OTP	raivo-otp.com	—	App Store
FreeOTP	GitHub - FreeOTP	Google Play	App Store
andOTP (archived)	GitHub - andOTP	Releases Page	—

 

[Gemma]

Ran my email through HIBP - five breaches

Changed my passwords and turned on 2FA.

 

[Bad Gizmo]

My Telegram account had some weird login attempt yesterday. No 2FA on it (oops). It could be a coincidence, but after reading this, I'm not taking chances. Activated everything I could.

 

[Beckie]

What do you do if you reuse the same password across loads of accounts?

I feel like I need a total digital detox just to sort this mess.