In June 2025, cybersecurity researchers uncovered one of the largest credential leaks in history: over 16 billion usernames and passwords from major platforms, including Apple, Google, Facebook, Telegram, and government portals, have been found circulating online.
Contrary to what many believe, this massive breach was not due to direct attacks on those companies’ servers, but rather through infostealer malware infecting user devices. These malware strains silently collect login data when users access websites or services and later upload them to criminal servers.
What Does This Mean for Users?
It means your accounts may already be compromised without your knowledge — even if the original service provider was not hacked. The threat is real, and action is necessary.
Immediate Steps to Take
For Consumers:
- Change all your passwords immediately, especially on email, banking, and social media accounts.
- Use strong and unique passwords for each platform.
- Enable multi-factor authentication (MFA) or passkeys — do not rely solely on passwords.
- Use password managers to avoid reusing credentials.
- Activate alerts for account activity and monitor for unusual logins.
- Stay alert against phishing emails and malicious links pretending to be legitimate services.
For Businesses:
- Train employees on cybersecurity hygiene and phishing awareness.
- Apply strong encryption, regular backups, and off-site storage.
- Restrict access to personal data via role-based controls.
- Conduct regular security audits and penetration tests.
- Implement and regularly test an Incident Response Plan (IRP).
- Be prepared to notify data subjects and the supervisory authority (e.g., the Hellenic DPA) within 72 hours, in line with GDPR Article 33 and 34 respectively, should any breach comes to your attention.
Know Your Rights (Under the GDPR)
As a data subject, you have:
- The right to be informed if your personal data has been compromised.
- The right of access, rectification, and erasure of your personal data.
- The right to lodge a complaint with the national data protection authority.
A Coordinated Approach to Security
Responding to such large-scale breaches requires shared responsibility:
- Consumers must adopt safe digital practices.
- Businesses must invest in organizational and technical safeguards.
- Legal compliance ensures transparency, accountability, and minimization of risk.
For legal guidance, cybersecurity policies, or data protection compliance audits, our office is here to support you.