The biggest data breaches leaked passwords for 11.7 billion accounts, two thirds of all the accounts Have I Been Pwned has loaded.

What is the largest data breach in history?

Within the Have I Been Pwned dataset, the biggest data breach in history by accounts exposed is the Synthient Credential Stuffing Threat Data, at 1.96 billion accounts, 11.0% of the 17.7 billion total. It is not a single company hack but a compilation of logins assembled from many earlier breaches.

Outside this dataset, definitions of the largest data breaches shift depending on what is counted. Cybersecurity Ventures ranks the 2013 Yahoo breach, which compromised all 3 billion user accounts, as the largest data breach in history among intrusions into a single company, noting that attackers believed to be state-sponsored stole names, email addresses, phone numbers, birthdates, and encrypted passwords.⁴ Huntress and Termly both place Yahoo second overall, behind the 2025 credential compilation of more than 16 billion records assembled largely from infostealer malware.^{2, 6} The chart's limit note explains why Yahoo appears much smaller here: HIBP's only Yahoo entry covers a 2012 leak of 453,427 accounts, and the 2013 breach data did not reach HIBP in comparable form.

Why do so many breaches expose billions of accounts at once?

The largest data breaches reach billions of accounts because the biggest entries are not single-company hacks but compilations: credential stuffing lists, combo lists, stealer logs, and spam lists that aggregate passwords and emails from hundreds of earlier, smaller breaches into one searchable dataset.

The 2025 credential compilation illustrates the pattern. Cybernews researchers found 30 datasets totalling more than 16 billion login records, most of it sourced from infostealer malware that quietly captured plain-text passwords from infected devices over several years, then bundled the results through dark-web markets.⁵ According to SecPod, the largest single dataset within that compilation held roughly 3.5 billion entries.⁵ Termly notes that the attack was coordinated using infostealer malware thought to have harvested data directly from users' devices, covering credentials for Google, Facebook, Apple, GitHub, and Microsoft.⁶ The chart reflects the same dynamic: 40 of its 1,042 entries, totalling 3.09 billion accounts, are compilations not verified by HIBP, and 16 are spam lists covering 1.47 billion accounts. A single reused password can therefore appear in dozens of these aggregated lists long after the original breach that exposed it.

Who is most at risk when passwords are leaked in a data breach?

Anyone who reuses a password across multiple sites is most at risk when passwords are leaked in a data breach, because one exposed credential can unlock every account where that same password was used.

According to Dexpose, the single biggest reason the same alert keeps resurfacing across multiple accounts is password reuse: one exposed password used on five different sites triggers the same warning five times.³ A leaked password does not require the person to have been personally hacked. Dexpose explains that credential databases are compiled over years from many unrelated sources, including old breaches, infostealer malware on other people's machines, and recycled leak compilations, so a password simply matching an entry in one of those databases is enough to put an account at risk.³

Accounts with stored payment details or long-term subscription value face heightened exposure. According to Tech Insider, Square Enix accounts are a persistently attractive target because they carry purchased expansions, cosmetic items, a subscription billing history, and sometimes a linked payment method, and a hijacked account with an active subscription carries resale value on gray markets.¹ Dexpose recommends changing any flagged password immediately, updating every other account using the same password, and enabling two-factor authentication, which adds a barrier that a leaked password alone cannot bypass.³

What do security experts say about credential stuffing attacks?

Security experts and platform operators describe credential stuffing as an automated, industrial-scale attack that requires no vulnerability in the targeted service, only a list of username-password pairs stolen from somewhere else.

Square Enix confirmed on Oct 19 that attackers had combined email addresses or account IDs and passwords believed to have leaked from other online services to attempt unauthorized logins, a textbook description of the technique.¹ Tech Insider notes that Square Enix became the fourth major gaming platform to issue a public account-security warning in October alone, following incidents at Discord, Steam, and PlayStation Network.¹ According to Tech Insider, attackers run scripts or commercial credential-checking tools that fire thousands of login attempts per minute, spreading traffic across many IP addresses through residential proxy networks or compromised devices so the requests resemble ordinary traffic.¹ Even a low success rate pays off at scale: if one in every few hundred attempts succeeds against a list of millions of stolen pairs, an attacker still walks away with thousands of working accounts.¹

Square Enix recommended enabling one-time password authentication and, according to English-language coverage cited by Tech Insider, said the company could move to a broader forced password reset if the volume of attempts keeps climbing, though no mandatory multifactor rollout had been confirmed as of Oct 19.¹