In May 2026, researchers disclosed what's been called the largest credential leak ever assembled: roughly 16 billion username and password pairs sitting in a publicly accessible dataset. Coverage was everywhere, and the panic was immediate.
If you've been asked by a board member, a client, or a worried family member whether they're "in the breach", here's what you actually need to know — and what we're advising Australian businesses to do about it.
What Was Actually Leaked
The "16 billion" figure is real, but it's not a single fresh hack. The dataset is a compilation — an aggregated dump pulling together:
- Logs from infostealer malware running on infected personal and corporate devices
- Older breach corpora that have circulated in criminal markets for years
- Some genuinely new credentials harvested in late 2025 and early 2026
A separate, smaller-but-fresher leak deserves more attention: a misconfigured public cloud database exposing roughly 149 million credentials for Gmail, Instagram, TikTok, Facebook, OnlyFans and others — almost entirely infostealer output. That one is closer to a "this week" threat than a historical archive.
The 16 billion number is sensational. The 149 million one is the one that should change your behaviour.
Why This Keeps Happening
Two structural reasons:
- Infostealer malware is cheap. Off-the-shelf info-stealing tools run for tens of dollars and quietly siphon every saved browser password, session cookie, and crypto wallet from an infected machine. One employee's home PC playing a pirated game can leak the password to your CRM.
- Password reuse is universal. The same password used for a forum in 2019, a streaming service in 2022, and your Microsoft 365 tenant today is the attacker's favourite lever. Credential-stuffing tools test these combinations against business systems at scale.
The result: even if your company has never been breached, your staff's credentials are almost certainly already in someone's dataset.
Are You Affected? (Probably, Partially)
Almost every Australian adult with more than a few online accounts has at least one credential in one of these dumps. Practical ways to check:
- Have I Been Pwned — free, run by security researcher Troy Hunt; check individual email addresses and enable domain-wide notifications if you own the domain.
- Microsoft Entra ID (Azure AD) leaked credentials report — if you run Microsoft 365 with Entra ID P1 or P2, this lights up automatically when Microsoft sees a match for one of your users.
- Browser password manager warnings — Chrome, Edge, and Safari now flag reused or exposed passwords in their built-in managers.
The honest answer for almost any business is: assume yes, and act accordingly.
What Actually Helps (And What Doesn't)
Doesn't help much
- "Change all your passwords" as a one-time fix. If the underlying problem is infostealer malware on a device, the new password leaks the moment it's typed.
- Forced 90-day password rotation. ACSC, NIST and Microsoft all moved away from this years ago — it produces predictable variants ("Summer2026!") that are easier, not harder, to guess.
- Complexity rules alone. "Must contain a symbol" stopped being useful when attackers started using leaked-password dictionaries instead of brute force.
Does help
- Phishing-resistant MFA on everything that matters. Passkeys (FIDO2) and hardware tokens defeat both credential reuse and most real-time phishing. SMS and email codes are better than nothing but increasingly bypassed via SIM-swap and adversary-in-the-middle attacks.
- A managed password manager with breach monitoring. Per-account unique passwords plus automatic alerts when any of them appear in a leak. For SMEs this typically means 1Password Business, Bitwarden, or a Microsoft-native combination of Entra ID + Edge.
- Endpoint protection that catches infostealers. Modern EDR (Defender for Endpoint, CrowdStrike, SentinelOne) detects the credential-harvesting behaviour even when the malware is brand new.
- Conditional Access policies. Block sign-ins from impossible-travel locations, unmanaged devices, and risky session signals. Even if the password leaks, the session can't.
- Aligning to Essential Eight Maturity Level 1. MFA is one of the eight; the rest of the framework closes the surrounding gaps (application control, patching, admin privilege restriction) that make a stolen credential dangerous in the first place.
What We're Doing for Clients
Two practical actions we've been running across our Sydney client base over the last few weeks:
- Auditing Conditional Access policies to ensure MFA is genuinely enforced on every user, not just the ones who haven't yet found the loophole.
- Rolling out passkey enrolment for clients on Microsoft 365 Business Premium and above — passwordless sign-in is now mature enough for production SME use, and it removes the entire class of password-reuse risk.
If you'd like us to run a no-obligation review of your tenant's identity posture against this leak — including which of your accounts already appear in known dumps — we can usually turn that around in a week.
The Bottom Line
A 16 billion credential dump is not a reason to panic, and it's not a reason to ignore the headlines either. It's a reminder that the password as a sole authenticator is finished, and the businesses that get ahead of that — with MFA, passkeys, and credential monitoring as standard — are the ones that won't be writing an apology email this time next year.
Need help working out where your business sits? Get in touch or run our free IT health check.