News

Scientists can manipulate air bubbles trapped in ice to encode messages.

A cyber-attack by pro-Iranian group Cyber Fattah has leaked personal information from the Saudi Games online

A cyber-attack on CoinMarketCap exposed users to a fake Web3 wallet prompt, draining $43,266 from wallets

The DHS warned of a heightened risk of cyber and physical attacks on US targets by Iran in retaliation for strikes on Iranian nuclear facilities over the weekend

The UK government’s Cyber Essentials scheme hits 10,000 certifications for the first time in a quarter but challenges persist

SecurityScorecard has discovered a covert cyber-espionage botnet dubbed “LapDogs” linked to China

It was a recently unimaginable 7.3 Tbps:

The vast majority of the attack was delivered in the form of User Datagram Protocol packets. Legitimate UDP-based transmissions are used in especially time-sensitive communications, such as those for video playback, gaming applications, and DNS lookups. It speeds up communications by not formally establishing a connection before data is transferred. Unlike the more common Transmission Control Protocol, UDP doesn’t wait for a connection between two computers to be established through a handshake and doesn’t check whether data is properly received by the other party. Instead, it immediately sends data from one machine to another.

UDP flood attacks send extremely high volumes of packets to random or specific ports on the target IP. Such floods can saturate the target’s Internet link or overwhelm internal resources with more packets than they can handle.

Since UDP doesn’t require a handshake, attackers can use it to flood a targeted server with torrents of traffic without first obtaining the server’s permission to begin the transmission. UDP floods typically send large numbers of datagrams to multiple ports on the target system. The target system, in turn, must send an equal number of data packets back to indicate the ports aren’t reachable. Eventually, the target system buckles under the strain, resulting in legitimate traffic being denied.

Reports last week detail a “16 billion password leak”, with major news outlets worldwide proclaiming this as one of the “largest data breach in history. The exposed dataset appears to be a massive compilation of previously leaked login credentials combined with recent information harvested from devices infected with a type of malware called an infostealer. The vast amount of stolen login credentials, especially from the platforms people use and rely on every day, serves as a powerful reminder of the need for up-to-date online security combined with strong cyber hygiene. 

Why This Matters  

If cybercriminals get hold of your login credentials, the consequences can be serious—think hijacked social media accounts, stolen identities, phishing attacks launched from your personal email account, and potentially even financial loss. The good news? You can take action right now to boost your security and stay protected from scammers. 

The Real Threat You’re Facing 

Don’t let the “old data” narrative fool you into complacency. As McAfee CTO Steve Grobman notes: “With over 16 billion login credentials exposed worldwide, the scale of this breach is a stark reminder of the prevalence of data leaks and the importance of practicing good cyber hygiene.” 

This compilation represents a significant threat because: 

Password Reuse Amplifies Risk: If you reuse passwords across multiple sites, one stolen credential can unlock multiple accounts.  

Social Media Account Takeovers: “Email and social media logins are particularly valuable, as they allow scammers to reset passwords and dig even deeper into someone’s digital life, even impersonating victims,” Grobman explains. 

Identity theft: With access to information, like the username and password for your banking or financial account, cybercriminals could steal your identity to open new accounts, apply for loans, and commit fraud. 

Increase in Phishing Attacks: In Grobman’s words: “For cybercriminals, this data is gold. It gives them everything they need to scam, impersonate, and steal. With a trove of personal information circulating widely, people should be on high alert for targeted scam emails and texts that look like they’re from trusted brands or known contacts.” 

Ongoing Infostealer Infections on Unprotected Devices: New databases appear “every few weeks” with “fresh, weaponizable intelligence” which means that without the right protection you may have malware on your device silently stealing your data. And according to the researchers, the problem isn’t getting better—it’s accelerating. 

Your Action Plan: Focus on What Matters 

Following McAfee’s official guidance, here’s what you need to do immediately: 

Step 1: Check for Infections First

Before changing any passwords, scan your devices for malware. If you’re concerned that an infostealer might be present on your computer, scan your device with a trusted antivirus program before changing any passwords. Otherwise, newly entered credentials could be stolen as well. 

Step 2: Update Critical Passwords

Steve Grobman’s recommendation is clear: “Now is the time to update passwords – especially for email, banking, and shopping accounts.” You should:  

• Check McAfee’s identity monitoring and alerts service to see if your email appears in known breaches. 

• Audit your password reuse—if you use the same password on multiple sites, prioritize changing those first. 

• Focus on critical accounts: Email, banking, social media, and shopping sites. 

Step 3: Implement Strong Authentication

Enable Two-Factor Authentication everywhere possible. As our CTO recommends: “Enable two-factor authentication wherever possible” to add that crucial second layer of security. 

Use authenticator apps, such as Google Authenticator, Duo, and Authy, and do not use SMS. You should avoid using SMS texts to receive 2FA codes, as threat actors can conduct SIM-swapping attacks to hijack your phone number and obtain them. 

Step 4: Deploy Scam Detection Technology

Given the elevated risk of targeted scams using your real information, Grobman specifically recommends: ” Use scam detection technology, like McAfee’s Scam Detector, to help flag risky messages before they cause harm.” 

Why Professional Identity Protection Is More Critical Than Ever 

While this specific data compilation may contain both older and newer data, it highlights a fundamental truth: your credentials are constantly being targeted by cybercrooks. 

The Infostealer Epidemic

The infostealer problem has gotten so pervasive that manual monitoring simply isn’t sufficient anymore. You need automated, professional-grade protection that works 24/7. 

How McAfee+ Addresses Modern Threats 

• Scam Detection: We protect you from scams with a powerful, AI-powered defense system that works across all your devices. Our scam protection technology identifies and blocks phishing attempts that use your real credentials from compilations like this 16 billion record database. 

• Comprehensive Dark Web Monitoring: We continuously scan the dark web, including criminal marketplaces, where infostealer logs and credential compilations are sold, alerting you immediately if your information appears in new dumps. 

• Credit Monitoring: Our Advanced and Ultimate plans provide up to three-bureau credit monitoring, catching activity on your credit report that may be indicators of identity fraud. 

• Personal Data Cleanup: One of our most powerful features automatically removes your information from data broker databases—the same sources that often feed into massive credential compilations. By reducing your digital footprint, we make you a harder target. 

• Expert Identity Restoration: If criminals successfully use old credentials to compromise your identity, our specialist team provides step-by-step guidance for complete recovery, backed by up to $2 million in identity theft insurance.

Proactive vs. Reactive Security

Traditional approaches wait for you to discover you’ve been compromised. McAfee’s approach is different: 

• Monitor continuously for your personal info where it shouldn’t be. 

• Alert immediately when threats are detected. 

• Respond automatically to remove your data from risky sources. 

• Restore professionally if you’ve been impacted by a breach. 

The Bigger Picture: Why This Won’t Be the Last

There are thousands, if not hundreds of thousands, of similarly leaked archives being shared online, resulting in billions of credentials records released for free. This 16 billion record compilation is just the latest in an ongoing parade of massive credential dumps. 

Previous Examples:

• RockYou2024: Over 9 billion records 

• Collection #1: Over 22 million unique passwords 

• Countless smaller compilations are released weekly 

The Trend Is Accelerating: As infostealers have become so abundant and commonly used, threat actors release massive compilations for free on Telegram, Pastebin, and Discord to build reputation and attract customers to their paid services. 

Long-Term Protection Strategy

Assume You’re Already Compromised

Given the scale of credential theft over the years, assume some of your information is already in criminal hands. This mindset shift changes everything: 

• Use unique passwords everywhere—password reuse is your biggest vulnerability 

• Enable 2FA on all critical accounts—your second line of defense 

• Monitor automatically—manual checks may cost you precious time needed to change your password and secure your login. 

• Respond quickly—time is critical when credentials are exploited 

Build Defense in Depth

• Device Security: Keep systems updated and use reputable antivirus software to prevent infostealer infections. 

• Network Security: Use VPNs on public networks and be cautious about which devices access sensitive accounts. 

• Identity Monitoring: An automated service that scans the dark web and lets you know if your personal info is found there. 

• Credit and Transaction Monitoring: Lets you know if you have activity on your credit report and financial accounts. 

Take Action: Don’t Wait for the Next Data Leak

Your credentials are valuable to criminals, and they’re actively working to steal and exploit them. The question isn’t whether your information will appear in future compilations—it’s whether you’ll be protected when it does. 

McAfee Identity Monitoring provides timely dark web alerts, complete with guidance on how to quickly secure your info if they’re found in breaches. 

Get McAfee+, with all-in-one scam, privacy, and identity protection and gain immediate access to: 

• Dark web monitoring for timely alerts and quick steps to fix breaches. 

• Personal data cleanup to remove your info from data broker sites. 

• Credit and Transaction Monitoring 

• Expert identity restoration support 

• Up to $2 million in identity theft insurance 

• AI-powered scam protection 

• 24/7 security support 

Remember: Take this opportunity to update your passwords immediately and improve your cybersecurity habits — because the threat is real, ongoing, and growing. 

 

 

The post 16 Billion Stolen Logins for Apple, Google, Facebook and More: How to Stay Safe appeared first on McAfee Blog.

The UK’s Cyber Monitoring Centre (CMC) assessed the incident as a Category 2 systemic event, based on the significant economic impact

Oxford City Council revealed that attackers accessed data of individuals who worked on Council-administered elections between 2001 and 2022