Massive Addition of Nearly 2 Billion Compromised Accounts to Have I Been Pwned

Have I Been Pwned (HIBP), the widely used data breach notification service, has indexed nearly 2 billion unique email addresses and 1.3 billion passwords from newly obtained datasets, marking the largest single update in the platform's history. The data, sourced in part from threat intelligence provider Synthient, includes both stealer log data—collected by malware from infected machines—and credential stuffing lists, which are typically compiled from previous breaches and used to facilitate unauthorized access to accounts across multiple services. This update brings the total number of accounts tracked by HIBP to over 15 billion, significantly expanding the visibility of exposed credentials for individuals and organizations.

The newly indexed records include 183 million unique email addresses uploaded on October 21, as well as a much larger corpus totaling nearly 2 billion addresses and 1.3 billion passwords, 625 million of which were previously unseen. Users are encouraged to check their exposure using HIBP's free search tools and to take immediate action if their credentials are found, such as changing passwords and enabling multi-factor authentication. The scale and diversity of the data highlight the ongoing risks of password reuse and the importance of proactive credential management to mitigate the threat of account takeover attacks.