Nearly 10 Billion Passwords Leaked in Largest Password Compilation Ever

It’s time to change your passwords.

A text file posted on hacker forums contains the largest password dump in history. The file, called “rockyou2024.txt,” contains 9,948,575,739 passwords, according to security research firm Cybernews.

The compilation is essentially a combination of existing known passwords from hacks going back more than 20 years, as well as new data breaches. While tying passwords to specific usernames is clearly dangerous for a website’s users, the real threat comes from what a dump of this size allows hackers to do: brute force attacks.

In essence, this dump gives hackers a huge springboard from which to launch brute force attacks to gain access to user accounts and sensitive data. As such, it is imperative that affected users (which likely includes most internet users worldwide) change their passwords as soon as possible.

In addition to changing passwords, people should also enable two-factor authentication (2FA) where available. This adds an extra layer of security when logging in; even if someone has a username and password, 2FA requires a login attempt to be verified on a separate device or through a separate path. A hardware-based 2FA method (such as the Yubico YubiKey 5Ci, currently available on Amazon for $75) is preferable to an account-based method (such as emailing an authentication code), because a hacker could have access to an email account and thus gain access to a 2FA code.

Password managers are also a great way to access and update passwords en masse. There are many free and secure options available, such as KeePass XC.