A database holding roughly 24 billion stolen login records sat open on the internet for at least three days this month, and it contained a lot more than passwords. Session cookies, multi-factor tokens, browser autofill data and crypto wallet details were in there too. This article explains what was actually found, why the headline number needs context, and, more usefully, the six things to do this week in the order that matters.
What was found, and why "record-breaking" needs context
Researchers at Cybernews found an unsecured Elasticsearch cluster on June 12, 2026 containing about 24 billion records and 8.3 TB of data. It went offline by June 15. Malwarebytes, which covered the find on June 17, reports that the data came from 36 sources: Telegram channels, earlier breach compilations, infostealer logs and datasets that appear to have been exported from live servers.
Before you panic about "24 billion," keep three things in mind. First, the researchers could not say how many records were duplicates, how old most of the data was, or who assembled it. Second, around 22.6 billion of the records were grouped under a "collections" label, which strongly suggests recycled compilations of older stolen data. Third, this is not the first time. A year ago, in June 2025, Cybernews reported 16 billion exposed credentials across 30 datasets, with the same caveats about overlap.
So the accurate framing is not "24 billion people were hacked." It is that a snapshot of the criminal credential supply chain was briefly visible to anyone, and if you reuse passwords or have ever had malware on a PC, some of that snapshot is probably yours.
Where 24 billion records come from: infostealers, Telegram dumps and old breaches
The bulk of modern credential leaks no longer comes from companies being breached. It comes from infostealers, small pieces of malware that run on an infected Windows or macOS machine, scoop up everything the browser has saved, and upload it to a criminal server in seconds. Flashpoint's 2026 Global Threat Intelligence Report counted more than 11 million infostealer-infected machines in 2025, producing an inventory of 3.3 billion compromised credentials and cloud tokens.
Those logs are sold, traded and given away in Telegram channels; Malwarebytes reports that about 1.7 billion of the records in this cluster came from such channels, including ones trading stolen card data. Aggregators then merge fresh logs with decade-old breach dumps into ever-larger "collections," which is how one server ends up holding 24 billion rows.
Why session cookies and MFA tokens matter more than passwords
Here is the part most coverage skips. Changing a password does nothing if the attacker already has your session cookie. When you sign in to Gmail or Microsoft 365 and tick "stay signed in," the site hands your browser a token that proves you already passed the login and any 2FA challenge. Infostealers copy those tokens straight out of the browser. As Recorded Future explains, an attacker who replays a stolen cookie never triggers the authentication step, so multi-factor authentication never gets a chance to intervene.
That is why the records in this leak that should worry you most are not the plaintext passwords. They are the session cookies, MFA tokens and device fingerprints Malwarebytes lists, because they let someone walk straight into an account you thought was protected. It is also why step 3 below, signing out everywhere, is not optional.
Step 1: Check your exposure with Have I Been Pwned
Go to haveibeenpwned.com and enter each email address you use. The site tells you which known breaches and infostealer logs contain that address. Do this for old addresses too; a forgotten Yahoo or Hotmail account is often the recovery address for something that matters.
Two notes. A "not pwned" result does not mean you are clear, because this particular cluster went offline before it could be indexed and much of it may never be. And if HIBP shows your address in an infostealer log, treat that as a sign that a device you own or owned was infected, and jump to step 5 before doing anything else on that machine.
Step 2: Change reused passwords, starting with email
Malwarebytes' first piece of advice is to change any exposed password and stop reusing passwords across sites. Prioritize in this order:
- Your primary email account. It is the reset key to everything else.
- Banking, payment apps and any account with a stored card.
- Shopping accounts and cloud storage.
- Social media, which attackers use to scam your contacts.
If you have been reusing one or two passwords everywhere, this is the moment to move to a password manager and let it generate a unique password per site. Our Bitwarden vs 1Password vs Proton Pass comparison will help you pick one. Do not try to do all 200 accounts tonight; do the top ten today and work through the rest as you log in to them.
Step 3: Sign out everywhere and revoke sessions
This is the step that neutralizes stolen cookies. Every major provider has a way to end all active sessions:
- Google: open myaccount.google.com, choose Security, then under "Your devices" select Manage all devices. Google's help page walks through reviewing each device and choosing Sign out on anything you do not recognize. If you see a device you cannot explain, follow the secure-your-account flow rather than just signing it out. Our guide on what to do if your Google account is hacked covers that in detail.
- Microsoft: account.microsoft.com, Security, then "Sign out everywhere."
- Apple: Settings, your name, then scroll to the device list and remove unknown devices.
- Facebook, Instagram, X, Discord: each has a "Where you're logged in" or "Sessions" page under security settings with a log-out-all option.
Change the password first, then sign out everywhere, then re-sign in on your own devices. Doing it in that order means the old cookies are invalidated and the new session is protected by the new password.
Step 4: Turn on passkeys or app-based 2FA
Once the passwords are fresh, make them matter less. A passkey cannot be typed into a phishing site and is not stored in the browser's password database, so infostealers have nothing to grab. Our tutorial on setting up passkeys for Google, Apple and Microsoft takes about ten minutes per account.
Where passkeys are not offered, use an authenticator app or a hardware key rather than SMS codes. See our comparison of two-factor authentication methods for the trade-offs. And remember the caveat from earlier: 2FA protects the login, not an already-stolen session, so it is a complement to step 3, not a replacement.
Step 5: Scan the device that may have leaked them
If any of your credentials showed up in an infostealer log, or if you have ever installed a "cracked" app, a game cheat, or a browser extension you did not fully trust, assume a machine was infected. Run a full scan with a reputable anti-malware tool on every Windows PC and Mac you use. Remove browser extensions you do not recognize. Update the operating system and browser.
Then, and only then, log back in to your accounts on that device. Changing passwords on a still-infected PC just hands the attacker the new ones.
Step 6: Set up breach alerts so next time you hear first
Have I Been Pwned's Notify Me service is free and emails you whenever your address turns up in a newly indexed breach. Sign up every address you use. Most password managers now include a similar monitor that flags compromised logins inside the vault, and Google's Password Manager and Apple's Passwords app both warn about credentials that have appeared in known leaks. Turn those warnings on and act on them the day they arrive; the window between a log being stolen and being used is often short.
How infostealers get onto a PC: fake updates, cracked software and ClickFix
Preventing the next infection is cheaper than cleaning up after it. Malwarebytes lists the main delivery routes: malicious ads that lead to fake download pages, fake browser or software updates, pirated software and game cheats, and unverified browser extensions.
The one worth learning to recognize is ClickFix. Microsoft's analysis describes how a compromised or look-alike site shows a fake CAPTCHA, error message or "verify you are human" dialog, then instructs you to press Windows+R, paste with Ctrl+V, and press Enter. The clipboard has been silently loaded with a command that downloads an infostealer. No real CAPTCHA ever asks you to leave the browser and paste something into a Run box or Terminal. If a page asks for that, close the tab.
What is still unclear
Nobody knows who owned the exposed server, whether it was an aggregator, a researcher's mirror or a criminal operation, or how many people accessed it during the three days it was open. There is no reliable count of unique victims. What is clear is that the underlying supply of stolen logins keeps growing, and that the same steps protect you regardless of which dump makes the headlines next.
The 24 billion figure is inflated by duplicates and old data, but the mix of session cookies and MFA tokens makes this leak more dangerous than a plain password list. Check your addresses on Have I Been Pwned, change reused passwords starting with email, sign out of every session, switch the important accounts to passkeys, and scan any PC that might have been infected. Then set up breach alerts so the next dump is a notification, not a surprise.
Sources and further reading
- 24 billion stolen records exposed online. Here's what to do (Malwarebytes)malwarebytes.com
- 24 billion records, including usernames and passwords, exposed in colossal data leak (Cybernews)cybernews.com
- 24B Records Exposed in Massive Leak of Emails, Passwords, and Login Data (TechRepublic)techrepublic.com
- 16 billion login credentials from Google and other sites leaked online, report says (CBS News)cbsnews.com
- Navigating 2026's Converged Threats: Flashpoint Global Threat Intelligence Report (Flashpoint)flashpoint.io
- Think before you Click(Fix): Analyzing the ClickFix social engineering technique (Microsoft Security Blog)microsoft.com
- Session Hijacking and MFA Bypass (Recorded Future)recordedfuture.com
- See devices with account access (Google Account Help)support.google.com
- Have I Been Pwned: Notify Mehaveibeenpwned.com