Unprecedented Breach Exposes 1.3 Billion Passwords and 2 Billion Email Addresses

On November 18, 2025, cybersecurity experts revealed that a massive data breach has exposed 1.3 billion unique passwords and nearly 2 billion email addresses. The breach, which is the largest of its kind, was processed by the online service Have I Been Pwned (HIBP).

HIBP CEO Troy Hunt, who admitted that his own password was part of the leaked data, stated that this corpus is nearly three times the size of the previous largest breach the service has ever processed. The dataset includes 1,957,476,021 unique email addresses and 625 million passwords that had never been seen before by HIBP.

Researchers have warned that with over 5.5 billion people worldwide using the internet, a staggering number of individuals likely had at least some of their accounts compromised. The breach combined past data breaches with credential-stuffing lists, a type of data used by attackers to try stolen passwords across multiple accounts.

Cybersecurity experts are now urging immediate action, advising individuals to use secure password managers and create unique, strong passwords for each account. They also recommend enabling two-factor authentication on all accounts, especially for email and administrative logins. Organizations are advised to run credential checks, implement breach-password detection, and audit access privileges to mitigate the risks posed by this unprecedented data breach.