https://www.zdnet.com/article/massive-data-breach-exposes-184-million-passwords-for-google-microsoft-facebook-and-more/ X Trending * Memorial Day tech sales 2025 * Memorial Day TV sales 2025 * Memorial Day lawn & outdoor sales 2025 * Memorial Day phone sales 2025 * Memorial Day health tracker sales 2025 * Memorial Day headphone sales 2025 * Memorial Day laptop sales 2025 * Best CRM software of 2025 * * Best small business CRM software of 2025 * Best free website builders of 2025 * Best website builders of 2025 * Best free web hosting services of 2025 * Best malware removal software of 2025 * Best remote access software of 2025 * Best password managers for families in 2025 * Best password managers for businesses of 2025 * * Best business VoIP providers of 2025 * Best data removal services: Delete yourself from the internet * Best email hosting service * Best VPS hosting service * How to clear the cache on your Windows 11 PC * Finally, a Windows 11 tablet I'd recommend to both business and professional users * NEO QLED vs OLED: Which TV tech is right for you? * ZDNET Recommends Tech * Gaming * Headphones * Laptops * Mobile Accessories * Networking * PCs * * Printers * Smartphones * Smart Watches * Speakers * Streaming Devices * Streaming Services * * Tablets * TVs * Wearables * * Kitchen & Household * Office Furniture * Office Hardware & Appliances * Smart Home * Smart Lighting * Yard & Outdoors Innovation * Artificial Intelligence * AR + VR * Cloud * Digital Transformation * Energy * * Robotics * Sustainability * Transportation * Work Life * * Accelerate your tech game Paid Content * How the New Space Race Will Drive Innovation * How the metaverse will change the future of work and society * * Managing the Multicloud * The Future of the Internet * The New Rules of Work * The Tech Trends to Watch in 2023 Business * See all Business * Amazon * Apple * Developer * E-Commerce * * Edge Computing * Enterprise Software * Executive * Google * Microsoft * * Professional Development * Social Media * SMB * Windows * * How AI is transforming organizations everywhere * The intersection of generative AI and engineering * Software development: Emerging trends and changing roles Security * See all Security * Cyber Threats * Password Manager * Ransomware * VPN * * Cybersecurity: Let's get tactical * Securing the Cloud Advice * Deals * How-to * Product Comparisons * Product Spotlights * Reviews Buying Guides * See all Buying Guides * Best Samsung phones * Best Android phones * Best smart rings * Best blood pressure watches * Best headphones for sleeping * * Best robot vacuum mops * Best web hosting services * Best travel VPNs * Best VPNs * Best AI image generators * Best AI chatbots * * Best 75-inch TVs * Best smartphones * Best iPhones * Best MagSafe battery packs * Best digital notebooks * Best TV antennas * * Best TVs * Best laptops * Best tablets * Best smartwatches * Best headphones * Best live TV streaming services tomorrow belongs to those who embrace it today * ZDNET France * ZDNET Germany * ZDNET Korea * ZDNET Japan [ ] Go * See all Topics * Finance * Education * Health * Special Features * ZDNET In Depth * ZDNET Recommends * Newsletters * Videos * Editorial Guidelines * Trending * Memorial Day tech sales 2025 * Memorial Day TV sales 2025 * Memorial Day lawn & outdoor sales 2025 * Memorial Day phone sales 2025 * Memorial Day health tracker sales 2025 * Memorial Day headphone sales 2025 * Memorial Day laptop sales 2025 * Best CRM software of 2025 * Best small business CRM software of 2025 * Best free website builders of 2025 * Best website builders of 2025 * Best free web hosting services of 2025 * Best malware removal software of 2025 * Best remote access software of 2025 * Best password managers for families in 2025 * Best password managers for businesses of 2025 * Best business VoIP providers of 2025 * Best data removal services: Delete yourself from the internet * Best email hosting service * Best VPS hosting service * How to clear the cache on your Windows 11 PC * Finally, a Windows 11 tablet I'd recommend to both business and professional users * NEO QLED vs OLED: Which TV tech is right for you? * ZDNET Recommends * Tech * Gaming * Headphones * Laptops * Mobile Accessories * Networking * PCs * Printers * Smartphones * Smart Watches * Speakers * Streaming Devices * Streaming Services * Tablets * TVs * Wearables * Kitchen & Household * Office Furniture * Office Hardware & Appliances * Smart Home * Smart Lighting * Yard & Outdoors * Innovation * Artificial Intelligence * AR + VR * Cloud * Digital Transformation * Energy * Robotics * Sustainability * Transportation * Work Life * Accelerate your tech game Paid Content * How the New Space Race Will Drive Innovation * How the metaverse will change the future of work and society * Managing the Multicloud * The Future of the Internet * The New Rules of Work * The Tech Trends to Watch in 2023 * Business * See all Business * Amazon * Apple * Developer * E-Commerce * Edge Computing * Enterprise Software * Executive * Google * Microsoft * Professional Development * Social Media * SMB * Windows * How AI is transforming organizations everywhere * The intersection of generative AI and engineering * Software development: Emerging trends and changing roles * Security * See all Security * Cyber Threats * Password Manager * Ransomware * VPN * Cybersecurity: Let's get tactical * Securing the Cloud * Advice * Deals * How-to * Product Comparisons * Product Spotlights * Reviews * Buying Guides * See all Buying Guides * Best Samsung phones * Best Android phones * Best smart rings * Best blood pressure watches * Best headphones for sleeping * Best robot vacuum mops * Best web hosting services * Best travel VPNs * Best VPNs * Best AI image generators * Best AI chatbots * Best 75-inch TVs * Best smartphones * Best iPhones * Best MagSafe battery packs * Best digital notebooks * Best TV antennas * Best TVs * Best laptops * Best tablets * Best smartwatches * Best headphones * Best live TV streaming services * More * See all Topics * Finance * Education * Health * Special Features * ZDNET In Depth * ZDNET Recommends * Newsletters * Videos * Editorial Guidelines Tech Home Tech Security Massive data breach exposes 184 million passwords for Google, Microsoft, Facebook, and more The file was unencrypted. No password protection. No security. Just a plain text file with millions of sensitive pieces of data. lance-31.png Written by Lance Whitney, Contributor May 23, 2025 at 8:45 a.m. PT * * * * * data breach concept JuSun/Getty Images Yet another data breach has exposed passwords and other sensitive information - but this one is a whopper. Cybersecurity researcher Jeremiah Fowler revealed his discovery of a massive online database containing more than 184 million unique account credentials, in a report published Thursday. Usernames, passwords, emails, and URLs for a host of applications and websites, including Google, Microsoft, Apple, Facebook, Instagram, and Snapchat, among others, were stored in a file. The database also contained credentials for bank and financial accounts, health platforms, and government portals. Also: The best password managers of 2025: Expert tested The problem? The file was unencrypted. No password protection. No security. Just a plain text file with millions of sensitive pieces of data. Based on his analysis, Fowler determined the data was captured by some kind of infostealer malware. A popular tool used by cybercriminals, an infostealer is designed to grab usernames, passwords, and other sensitive data from breached sites and servers. Once the criminals get their hands on the data, they can use it to launch their own attacks or peddle the information on the dark web. After finding the database, Fowler contacted the hosting provider, which removed it from public access. Since the provider would not disclose the name of the file's owner, Fowler said he didn' t know if the database was created legitimately and then accidentally exposed or intentionally used for malicious reasons. To check on the validity of the information, Fowler emailed many of the people listed in the file and told them that he was researching a data breach. Several of the individuals confirmed that the records contained valid account passwords and other data. Also: Oversharing online? 5 ways it makes you an easy target for cybercriminals Though the person or people behind the database and exposure are obviously to blame for this incident, users also share some of the responsibility. "Many people unknowingly treat their email accounts like free cloud storage and keep years' worth of sensitive documents, such as tax forms, medical records, contracts, and passwords, without considering how sensitive they are," Fowler said. "This could create serious security and privacy risks if criminals were to gain access to thousands or even millions of email accounts." In his report, the researcher highlighted the types of threats faced by people whose data is exposed in such breaches. * Credential stuffing attacks - People who use the same passwords on multiple accounts open themselves up to compromise. Hackers deploy automated credential stuffing scripts to try out different email and password combinations on thousands of different sites. The same password exposed on one site can then easily be exposed on others. * Account takeovers - Cybercriminals who gain access to usernames, passwords, and other private data are able to take over an account. They can steal your identity, commit financial fraud, and run other types of scams, not just on you but on family, friends, and other contacts. * Ransomware and corporate espionage - Fowler said he discovered many business credentials in the leaked data. The attackers can exploit this information to steal business records, launch ransomware attacks, and even commit corporate espionage. * Attacks against state and government agencies - Fowler also saw several government accounts across different countries. An attacker armed with this information can target state and federal agencies. * Phishing and social engineering - Leaked emails provide cybercriminals with a history of someone's conversations and contacts. That information can then be used in targeted phishing attacks against the account owner as well as people they know. How can you protect your own confidential data from being exposed in a breach? Though no perfect solution exists, Fowler shared the following tips in his report: 1. Change your passwords each year Many people have only one email address connected to multiple accounts, which means they can't easily change it. But you can change your password, at least periodically. Doing so is a good idea if you think your old password may have been compromised in a breach. 2. Use complex and unique passwords Beyond using strong passwords, avoid using the same one for multiple accounts. 3. Consider a password manager A password manager can take on the challenging role of creating, storing, and applying strong and unique passwords for each account. As Fowler pointed out, there is a risk in using a password manager. If your master password is ever stolen or compromised, a cybercriminal now has the key to unlock all your passwords. But that brings us to the next tip. Also: Hackers stole this engineer's 1Password database. Could it happen to you? 4. Use multi-factor authentication MFA offers a second level of authentication, typically through a code, authenticator app, or security key. If your password is ever breached, a cybercriminal can't access your account without that code. Make sure you use MFA on all available accounts, but especially ones for bank and financial services and password managers. Also: 10 passkey survival tips: Prepare for your passwordless future now 5. Check if your credentials have been leaked Services like HaveIBeenPwned will tell you if your email has popped up in any known breaches. If so, then make sure you change the password for the affected accounts. 6. Monitor the use of your accounts Some websites and services will alert you to suspicious login activity and other atypical behavior, just like your credit card company alerts you to potentially suspect transactions. Avail yourself of this feature whenever possible. 7. Use good security software The right security software can detect and eliminate infostealer malware and other known threats. Be sure to update your software with the latest definitions to defend yourself against new variants. Get the morning's top stories in your inbox each day with our Tech Today newsletter. Featured I let Google's Jules AI agent into my code repo and it did four hours of work in an instant I tried Google's XR glasses and they already beat my Meta Ray-Bans in 3 ways 6 things I did immediately after installing iOS 18.5 on my iPhone - and why you should too Why WFH isn't dead and how digital-first companies have a big AI advantage * I let Google's Jules AI agent into my code repo and it did four hours of work in an instant * I tried Google's XR glasses and they already beat my Meta Ray-Bans in 3 ways * 6 things I did immediately after installing iOS 18.5 on my iPhone - and why you should too * Why WFH isn't dead and how digital-first companies have a big AI advantage Editorial standards Show Comments Log In to Comment Community Guidelines Related Rebooting your phone daily is your best defense against zero-click attacks - here's why Your password manager is under attack: How to defend yourself against a new threat Most AI chatbots devour your user data - these are the worst offenders ZDNET we equip you to harness the power of disruptive innovation, at work and at home. * Topics * Galleries * Videos * Do Not Sell or Share My Personal Information * about ZDNET * Meet The Team * Sitemap * Reprint Policy * Join | Log In * Newsletters * Licensing * Accessibility * * * * * * (c) 2025 ZDNET, A Ziff Davis company. All rights reserved. Privacy Policy | | Cookie Settings | Advertise | Terms of Use