![\"FBI](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2025\/12\/1765640592_847_0x0.jpg\")
<\/p>\n<\/p>\n
FBI reveals 630 million stolen passwords.<\/p>\n
getty<\/p>\n
Updated December 14 with password manager usage advice following reports of a LastPass data breach caused by security failures and a no password required attack confirmed by Google, alongside the original reporting of the 630 million passwords revealed by the FBI following device seizures from a single hacker.<\/p>\n
Just when you thought things couldn\u2019t get any worse in terms of cybersecurity bad news this week, the FBI has revealed a staggering database of 630 million compromised passwords from multiple devices seized from a hacker. Here\u2019s what to know and how to check if your passwords are on the danger list. <\/p>\n
ForbesMicrosoft Worm Attack Warning \u2014 Act Rapidly And Change Passwords NowBy Davey Winder<\/a>FBI Finds 630 Million Stolen Passwords On Seized Hackers\u2019 Devices<\/p>\n Troy Hunt, the creator of the ingenious Have I Been Pwned and Pwned Passwords services, has confirmed that the Federal Bureau of Investigation has handed over a staggering list of 630 million compromised passwords<\/a> to add to the HIBP database of 17 billion compromised accounts. The FBI has been sending Hunt compromised passwords for four years, as uncovered during the course of cybercrime investigations, but what\u2019s concerning and almost unbelievable in equal measure is that the latest haul is from a single hacker. <\/p>\n \u201cThis latest corpus of data came to us as a result of the FBI seizing multiple devices belonging to a suspect,\u201d Hunt said<\/a>, adding that \u201dthe sheer scope of cybercrime can be hard to fathom, even when you live and breathe it every day.\u201d To which I can only say, indeed it is. <\/p>\n It seems that the hacked passwords have come from open and dark web marketplaces, Telegram channels and, inevitably, infostealer attacks<\/a>. <\/p>\n All of which means, of course, that not all of the 630 million credentials handed over to Hunt are going to be fresh to market, as it were. And, indeed, that appears to be the case following an initial HIBP team analysis: \u201cWe hadn’t seen about 7.4% of them in HIBP before,\u201d Hunt confirmed, \u201cwhich might sound small, but that’s 46 million vulnerable passwords we weren’t giving people using the service the opportunity to block.\u201d<\/p>\n Forbes41 Microsoft Zero-Days \u2014 Now Millions Of Users Face Update ChoiceBy Davey Winder<\/a>FBI Stolen Credentials Handover: How To Check If Your Passwords Are On The List<\/p>\n The good news is that all of the stolen credentials, all those compromised passwords, are now searchable from a single location, which leaves you a second or two away from discovering if any of yours are included.<\/p>\n Head to the Pwned Passwords<\/a> service, and enter your password. Don\u2019t worry, it\u2019s perfectly safe and won\u2019t put your passwords in any danger, just the opposite in fact. \u201cNo password is stored next to any personally identifiable data such as an email address,\u201d Hunt said, \u201cand every password is SHA-1 hashed.\u201d<\/p>\n Most importantly, do it now so you can change any passwords that are already compromised before your accounts fall victim to credential-stuffing attacks. I would also recommend that you use a password manager. Oh, and enable passkeys on any accounts that support them. Then there\u2019s the small matter of activating two-factor authentication<\/a> on all your accounts as well. Stay safe, even when the FBI finds the next big stolen password haul. It\u2019s only a matter of time. <\/p>\n ForbesHas Your Gmail Password Been Hacked? Check Now, Here\u2019s HowBy Davey Winder<\/a>Don\u2019t Ignore This FBI Discovery \u2014 Use A Password Manager Now<\/p>\n OK, so I\u2019ve already said you should use a password manager, but is that safe? It\u2019s a question I get asked all the time, especially after I have published reports about a password manager data breach<\/a>, or the latest hack attacks<\/a>. My answer is always the same: yes, absolutely. There is never any doubt in my mind, as an old hacker myself, and for good reason: password reuse and weak passwords make the life of a hacker so much easier. Believe me. The two are most certainly not mutually exclusive, quite the opposite, in fact. People use weak passwords because truly random, truly complex, truly strong ones are almost impossible to remember unless you are some kind of memory savant. Not totally so, of course, I know my 25+ character random master password that unlocks my password manager vault off by heart. I couldn\u2019t actually tell you what it is without a keyboard in front of me, as it\u2019s a muscle memory thing, at least that\u2019s what I call it. I only need to remember the first five characters, and the rest just follow automatically. But even that password would not be considered strong in any way if I were to then refuse it across all my accounts because if one got compromised, then they all get compromised.<\/p>\n It doesn\u2019t matter which password manager you use, provided it is from a trusted vendor. I always recommend standalone managers and apps rather than ones that are part of a web browser, as I prefer some level of separation between the two. But something like Apple Passwords, which comes free with iOS and macOS, is just as good a recommendation as the commercial 1Password application, in my opinion. Don\u2019t let this latest FBI warning go to waste; use it as an opportunity to up your password game.<\/p>\n