Your Email Address and Password Have Been Stolen, As Have Nearly 1 Billion Others
By: Jim Stickley and Tina Davis
December 8, 2025
Your email and password might already be in the hands of cybercriminals. Security expert Troy Hunt, who operates Have I Been Pwned, recently received 2 billion unique email addresses found across multiple malicious lists and internet sources, including 1.3 billion unique passwords, according to reports from TechRepublic. This isn’t just another data breach—it’s a massive aggregation of stolen credentials that could put your accounts at serious risk.
The Scoop
The data comes from an aggregated collection by security firm Synthient, which compiles information from various data leaks. After processing, the dataset contained only unique credentials that were intercepted by Infostealer software . These stolen credentials were either freely available on the internet or collected via Telegram groups.
Why This Matters
The access data was intercepted by infostealers, which are malware that get installed on various systems with the sole purpose of collecting sensitive data and passwords. These then either end up directly with hackers, who can use them for phishing campaigns and scam attempts, or they’re sold online to those who may have even more devious intentions . Having your password on this list means cybercriminals could already have the keys to your accounts, your email, financial accounts, social media, and everything else.
Take Action
Don’t wait. Visit Have I Been Pwned immediately and enter your email address to check if you’re affected. There is also a password checker on the site. You simply enter your password, as opposed to your email address and you can see if it’s been compromised. If it has, it may not be yours that was taken, but that password was used somewhere and could be used via credential stuffing to find your accounts.
If your credentials appear, change your passwords right away. Use unique, strong passwords for every account. Enable two-factor authentication wherever possible. Consider using a password manager to keep track of multiple complex passwords. Just keep in mind, if the password manager is compromised, so too are your passwords.
And Then There’s Phishing
Always keep in your mind that if your email address has been compromised at all, you are likely getting spam. A lot of that might be phishing. Watch out for malicious links and if you don’t know the sender or are not expecting any links, don’t click them. If you are not sure, independently verify the link with the sender. Don’t trust contact information in those emails without verification.
SUBSCRIBE TO WEEKLY NEWSLETTER
