Billions of exposed records from multiple sources over time are ripe for weaponization imminently, but cyber defenses are still playing catchup.

In what experts are calling an “unimaginable” data breach, some 16bn data records have been exposed from 30 separate databases, including user accounts from major providers such as Apple, Google, GitHub, Telegram, various VPN services, and more.

The databases range in size from millions to billions of entries, and only one — the so-called “mysterious” database with 184m records — had previously been reported in the media at the end of May 2025.

Investigators believe the records were primarily compiled through info stealer malware, deployed by cybercriminals and possibly some security researchers. The data was briefly accessible on the open internet before being locked down, but the true owners of these databases remain unidentified.

Experts caution that the actual number of affected individuals is impossible to determine, as many users have multiple accounts and there is likely significant data overlap. With approximately 5.5bn people online worldwide, the scope of the breach is currently unprecedented.

Unsecured databases continue to be a leading cause of such leaks, with many organizations failing to grasp the shared responsibility model required for cloud security. The exposed information is a goldmine for cybercriminals, enabling targeted phishing, identity theft, wire fraud, and ransomware attacks.

According to Bernard Montel, Technical Director and Security Strategist, Tenable, “this is not a new data breach. It’s the result of threat actors’ use of info stealer malware that has silently scraped usernames and passwords during breaches. This data has been bundled, traded, and resurfaced across underground forums. That said, it’s no less concerning.”

Montel added: “For organizations, it’s about understanding that this is a potential risk if these records correlate with over-privileged identities. Identities are the new perimeter given that compromised identities are at the centre of nearly every successful cyberattack.”

Researchers and experts are urging organizations and individuals to strengthen their cybersecurity practices to mitigate future risks.