The world shuddered at the news of a leak of 16 million user accounts. While part of the community is frantically changing passwords after headlines about the biggest password leak 2025, others are trying to find out whether a hack ever really happened.
The editors of Quickex looked into what is wrong with the story of the supposedly largest breach and what you should do so you don’t tempt fate and keep your cryptocurrency safe.
What We Know So Far About the Leak
On the evening of 19 June 2025, hundreds of headlines about the incident flooded social networks. The story was first reported by cybernews — giving birth to the now-famous catch-phrase cybernews password leak — and later appeared in Forbes, turning it into the day’s most-discussed topic.
The cybernews authors quote the following numbers:
- 30 separate data-sets surfaced online; each contained a site URL, a login and a password.
- In total, 16 billion passwords leaked.
- Most of the records are fresh and had never been published before.
According to the article, users of Facebook, Google and Apple, as well as Telegram and even some VPN services, were affected. Portuguese-speaking countries were allegedly hit the hardest.
The database was supposedly built with the help of infostealer malware: Trojans pulled valuable credentials from infected machines and handed them to attackers.
The most curious part is how the cyber-news team claims to have obtained the files: the troves became visible for a short time because the criminals themselves made a configuration mistake.
Did a Leak Even Happen?
Unfortunately, the team provided no hard evidence: no sample records, no screenshots, nothing. Readers must simply take their word for it.
Equally suspicious is the claim that the leaked passwords were stored in plain text. Storing passwords un-hashed violates every security baseline; even the laziest company salts and hashes them.
The opacity of the investigation has given reason to doubt the data themselves. Some experts believe journalists may have mis-read the troves, and the real number of entries could be far smaller.
The freshness of the dump is also questionable. Critics point out that cybernews often publishes similar “horror stories” — one was noticed in January 2024 — always with scant evidence.
Another red flag: the assertion that all the data are fresh implies the crooks gathered them in barely six months, an unrealistically short span for such volume.
How to Shield Yourself—and Your Crypto—from the Leak Fallout
As of this writing, the authors have provided no proof, so the scale may be exaggerated and the breach itself unproven. Nevertheless, to avoid risk — and because phrases like “leaked passwords Apple, Google” now dominate search trends — you should:
- Change the passwords on every crypto platform and any service you log into. Articles about stolen passwords what to do all start with this step.
- Use a password manager. All your passwords must be unique and long; stop recycling a pet’s birthday.
- Enable two-factor authentication wherever possible. It protects the account even if crooks have the password.
- Lock down login geography/IP. Many services let you whitelist trusted locations to block unknown devices.
- Check your addresses against services such as Have I Been Pwned and DeHashed. They help detect compromised records.
- Move most of your crypto offline. The safest place is cold storage on hardware wallets no one else can access.
And remember: if headlines shriek “accounts hacked from password leak”, verify the source before panicking. A preventive password change never hurts, even when the threat is unconfirmed.
Earlier, the Quickex team explained how to organise the safe storage of cryptocurrency.