![\"Username](\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2025\/10\/1761508509_130_960x0.jpg\")
<\/p>\n<\/p>\n
183 million passwords leaked.<\/p>\n
picture alliance via Getty Images<\/p>\n
Earlier this year, I reported on a data leak that included a whopping 184,162,718 passwords and logins<\/a> impacting the likes of Apple, Facebook and Instagram users. That data leak was disclosed on May 22, and now, in a rather spooky seeming coincidence, news of 183 million passwords and login credentials from an April 2025 breach has emerged. Adding the details of website URLs, email addresses and passwords to the Have I Been Pwned database, owner Troy Hunt said the data consisted of both \u201cstealer logs and credential stuffing lists\u201d including confirmed Gmail login credentials<\/a>. Here\u2019s what we know and what you need to do.<\/p>\n ForbesPayPal Users Warned \u2018Do Not Pay, Do Not Phone\u2019 As Attackers StrikeBy Davey Winder<\/a>What We Know About The 183 Million Passwords Data Leak<\/p>\n Have I Been Pwned is something a staple resource for anyone who is genuinely concerned about their account login security. Why so? Because it\u2019s the go-to for discovering when any of your email addresses, accounts, or passwords are found in data leaks, dark web password breach lists, and the like. Best of all, it\u2019s entirely free to use. When a new entry appears with the number of affected accounts being 183 million<\/a>, and the compromised data listed as email addresses and passwords, more than a few heads will pop up above the parapets and pay attention. Mine certainly did following the October 21 addition. <\/p>\n Having done some digging for further information, I was drawn to a lengthy analysis by Hunt himself, which looked inside the Synthient threat data provided to HIBP. Benjamin Brundage from Synthient revealed in a blog posting<\/a> that the data came from the results of monitoring infostealer platforms<\/a> across the course of close to a year. <\/p>\n ForbesAct Now \u2014 Microsoft Issues Emergency Windows Update As Attacks BeginBy Davey Winder<\/a><\/p>\n The total amount of information sent to HIBP comprised 3.5 terabytes of data, 23 billion rows of it in all. The output of the stealer logs concerned, Hunt said, consisted primarily of three things: website address, email address and password. \u201cSomeone logging into Gmail,\u201d Hunt wrote, \u201cends up with their email address and password captured against gmail.com, hence the three parts.\u201d Of course, there\u2019s a lot of recycling of credentials that goes on in the cybercriminal world, so Hunt initially wanted to check the freshness of the database he had in his hands.<\/p>\n An analysis of a 94k sample revealed 92% were not, in fact, new. \u201cMost of what has been seen before was in the ALIEN TXTBASE<\/a> stealer logs,\u201d Hunt confirmed. However, the math wizards out there will have noted that this steal leaves 8% that is new and fresh, or more than 14 million credentials if you extrapolate it. Actually, the final tally was 16.4 million previously unseen addresses in any data breach, not just stealer logs.<\/p>\n HIBP also checks to see if the credentials are genuine by sending out some of the details to people on the subscriber base who are impacted. \u201cOne of the respondents was already concerned there could be something wrong with his Gmail account,\u201d Hunt said, and that person was able to validate that the entry was \u201can accurate password on my Gmail account.\u201d<\/p>\n