Nearly 10 billion passwords exposed in biggest leak in history

Researchers at Cybernews have uncovered the largest password leak in history, in which nearly 10 billion passwords were exposed.

According to Cybernews, the data file named rockyou2024.txt was posted online on a popular hacker forum on July 4.

Someone named ObamaCare posted this document online.

Cybernews said that this person had previously leaked a lot of confidential data online, including the employee database of the international law firm Simmons & Simmons, as well as student applications to a university in the state of New Jersey (USA). According to Cybernews, this is the largest leak of its kind.

The leaked passwords come from a combination of old and new data breaches, based on a compilation of 8.4 billion passwords leaked in 2021 in a data file called RockYou2021.

Cybernews said the hackers grew the dataset by searching for leaked data on the internet, adding another 1.5 billion passwords from 2021-2024. RockYou2021 itself is a compilation of additional data from a 2009 breach, including millions of passwords for social media accounts.

According to Cybernews, it is likely that the latest version of RockYou contains information collected from more than 4,000 databases over two decades.

Researchers believe the passwords could be used to target not only online platforms but also internet-facing cameras and industrial hardware. The number of exposed passwords could lead to “a range of data breaches, financial fraud, and identity theft.”

According to Cybernews researchers, the RockYou2024 leak is essentially a collection of passwords from users around the world. To check if your personal data was exposed in the leak, users can use Cybernews' Leaked Password Checker.

Computer security software company McAfee said users concerned about the breach can protect themselves from fraud and identity theft by updating passwords on all accounts to strong, unique ones.

McAfee recommends using a password manager for secure storage; enabling two-factor authentication; monitoring bank and credit card statements for any suspicious and unauthorized transactions; and being wary of phishing emails, calls or texts as hackers often use these tricks to trick them into giving away important information.