A staggering data breach has exposed nearly 200 million passwords linked to some of the world’s biggest tech companies — including Facebook, Apple, Google, Netflix, Microsoft, Snapchat, and PayPal — prompting urgent warnings for users to change their login credentials immediately.
The breach was first discovered by cybersecurity researcher Jeremiah Fowler in partnership with Website Planet, who found the sensitive data in a publicly accessible online database. Although the database has since been taken offline, experts warn the stolen data may already be circulating in criminal networks.
What Was Stolen?
The compromised data reportedly includes:
-
Email addresses and usernames
-
Passwords (many in plaintext)
-
Autofill and browser cookie data
-
Financial information in some cases
The source of the breach is believed to be “infostealer” malware, which infects computers and mobile devices, silently extracting stored login data, emails, documents, and even banking details.
“It’s like a digital pickpocket that quietly collects everything it can find,” Fowler explained.
Platforms Affected
Among the tech services confirmed or suspected to be impacted are:
-
Facebook
-
Google
-
Microsoft
-
Apple
-
Snapchat
-
Netflix
-
PayPal
-
Discord
-
Roblox
-
Health and government platforms
Security professionals stress that even if users aren’t certain they were directly affected, it’s wise to act as though they were.
How to Protect Yourself
Cybersecurity experts urge the public to take these steps immediately:
-
Change all passwords, especially for email and financial accounts.
-
Use a <strong>password manager to generate strong, unique passwords.
-
Enable Two-Factor Authentication (2FA) for all major services.
-
Run antivirus software to detect malware like infostealers.
-
Regularly delete old sensitive emails and store important documents in encrypted cloud storage.
“Too many people treat their inbox like free cloud storage, keeping years of medical records, tax forms, and contracts,” said Fowler. “If criminals get access, the consequences could be devastating.”
What Happens Next?
Although the exposed database is now offline, there is no confirmation that the stolen data hasn’t already been downloaded or used for criminal purposes. Victims could face phishing attempts, identity theft, or unauthorized account access in the coming months.
Authorities and cybersecurity firms are continuing to investigate the full scope of the breach.
If you suspect suspicious activity on your accounts, contact your service provider’s fraud department immediately.
