Update, June 19, 2025 – This story has been updated with comments from Keeper Security’s co-founders about the breach and what users should do now.

If 184 million stolen passwords sounded bad last month, brace yourself — the number has now exploded to a staggering 16 billion leaked login credentials. This may be the largest password breach in history, and experts are calling it a “blueprint for mass exploitation.”

Here’s what happened, why it matters, and what you need to do immediately.

What Was Leaked — and How Bad Is It?

Researchers at Cybernews have been tracking this breach since early this year. According to lead investigator Vilius Petkauskas, the data dump includes 30 massive datasets, each containing tens of millions to billions of stolen credentials.

In total:
16 billion login records
Fresh data — not previously reported
Credentials linked to Apple, Google, Facebook, GitHub, Telegram, VPNs, government services, and more

This isn’t recycled data from old breaches. It’s new, high-value information — and it’s dangerous.

“This is not just a leak – it’s a blueprint for mass exploitation,” Cybernews warned.
“These are fresh, weaponizable credentials that open the door to pretty much any online service imaginable.”

Each record typically includes a URL, username/email, and password — the exact combo needed for account takeovers, phishing attacks, and identity theft.

Why It Matters for You (Yes, You)

Let’s be clear: if your credentials are in this leak, your online identity — from social media to banking — is now exposed.

This leak shows how vulnerable even the biggest platforms can be. And it’s a reminder that stolen passwords are a booming black market on the dark web. A few dollars can buy access to your digital life.

“Password compromise leads to account compromise, and that leads to the compromise of nearly everything we care about in today’s digital world,” said Keeper Security CEO Darren Guccione.

How This Keeps Happening

Some of the data was likely harvested using infostealer malware, while other records may have been unintentionally exposed in misconfigured cloud environments — a growing issue in enterprise security.

“This is a harsh reminder of how easy it is for sensitive data to be left exposed online,” Guccione said.
“If we’re lucky, a security researcher finds it and reports it. If not? A cybercriminal does.”

What You Should Do Right Now

1. Change your passwords immediately — especially for important accounts (email, banking, cloud storage).
2. Use a password manager — to generate and store strong, unique passwords.
3. Enable multi-factor authentication (MFA) — this adds a critical layer of protection.
4. Consider passkeys — they’re more secure than traditional passwords and are being rolled out by Google, Apple, and others.
5. Sign up for dark web monitoring — services can alert you if your data appears in leaked databases.

Organizations should also act fast. Guccione recommends adopting zero-trust security frameworks with strong access controls. “Access to sensitive systems must always be authenticated, authorized, and logged — no matter where the data lives,” he said.

Cybersecurity Is Everyone’s Responsibility

While companies must do more to protect user data, individuals also play a key role. That means avoiding reused passwords, staying alert to phishing scams, and not clicking sketchy links.

“Cybersecurity isn’t just a technical challenge — it’s a shared responsibility,” said Javvad Malik of KnowBe4.
“Use strong, unique passwords, and enable MFA wherever possible.”

Bottom Line

The 16 billion password leak is the latest — and largest — wake-up call. Don’t wait for your credentials to show up on a hacking forum. Take action now.

Change your passwords. Use a password manager. Switch to passkeys. Stay safe.

Source: Forbes – 16 Billion Apple, Facebook, Google And Other Passwords Leaked — Act Now

The post 16 Billion Passwords Leaked: What You Must Do Now to Stay Safe appeared first on Journos News - Breaking News, World News, Top Stories, Todays Headlines and Flash Reports.

US and European authorities have launched a powerful crackdown on a notorious hacking tool that has fueled countless cyberattacks across the globe. Known as Lumma, this tool has been linked to ransomware attacks, bank thefts, and other serious digital crimes, affecting hundreds of organizations worldwide.

On Wednesday, the US Justice Department announced it seized the computer systems that hackers used to access Lumma. Meanwhile, Microsoft successfully took control of or shut down 2,300 websites tied to this cybercriminal network, thanks to a court order.

This operation delivers a serious blow to a sprawling hacking enterprise that had been causing chaos, especially over the past two months. Microsoft reported discovering nearly 394,000 Windows computers infected with Lumma across the world.

Authorities say Lumma-powered attacks targeted a wide range of victims — including airlines, universities, hospitals, banks, US state governments, and even Fortune 500 companies. The FBI estimates that in 2023 alone, hackers using Lumma caused credit card fraud losses of $36.5 million.

However, the fight against Lumma hasn’t been straightforward. The lead developer of the software reportedly operates out of Russia, where versions of Lumma are openly sold on Telegram and other Russian forums for prices ranging from $250 to $1,000, according to Microsoft analysts.

US prosecutors have charged numerous Russian hackers in the past decade for cybercrimes against American targets, but only a few have been brought to justice in US courts. Russian officials have also resisted efforts to extradite accused cybercriminals.

When asked if the FBI knows whether Lumma’s developer is based in Russia or if they have contacted Russian authorities, Brett Leatherman, the FBI’s deputy assistant director for cyber operations, said he could not comment.

But Leatherman emphasized that the FBI’s strategy focuses on disrupting the entire hacking ecosystem — not just individual actors — to provide relief to victims.

“This is about cutting off the tools and infrastructure these criminals rely on,” Leatherman said. “Even if we can’t charge every individual, taking down this network helps protect the victims.”

This global crackdown involved a coordinated effort from Europol, American and European tech companies, and a Japanese cybersecurity group. This collaborative approach reflects the growing role tech firms play in tackling cybercrime worldwide.

Leatherman expressed hope that this takedown would also sow distrust within the cybercriminal network, further weakening their operations.

“This is part of a broader investigation into the group behind Lumma,” he said. “We aim to fracture their trust and dismantle their network.”

Source: CNN – US and European authorities crack down on hacking tool used by cybercriminals worldwide

The post US and Europe Shut Down Major Hacking Tool Used by Cybercriminals appeared first on Journos News - Breaking News, World News, Top Stories, Todays Headlines and Flash Reports.

A futuristic orb, a face scan, and a mission to separate humans from bots — that’s the pitch from Tools for Humanity, the startup co-founded by OpenAI’s Sam Altman. But when I gave it a try, the Orb couldn’t even verify me as human.

Turns out, that’s (sort of) by design.

The Orb is part of a bold attempt to fix a growing problem on the internet: telling real people apart from bots. With AI now able to solve CAPTCHAs and generate realistic fake identities, verifying humanity online is harder — and more important — than ever.

Enter the Orb: a sleek, sci-fi-looking device designed to scan your face and eyes, analyzing details like shape and light response to confirm your uniqueness. If it works, it grants you a WorldID, a digital credential that proves you’re human. That ID could be used across websites — from social media to banking — to cut through bot interference and fraud.

But when I stepped up to the Orb, it rejected me. The reason? My yellow-tinted blue-light blocking contact lenses. The device flagged my face as “blocked,” suggesting I might be trying to fool it.

“Well, that’s sad, but I’m grateful it rejected you,” joked Tiago Sada, Chief Product Officer at Tools for Humanity. “It means the system is doing its job.”

Sada says the Orb was built in response to bots running wild on the internet — scalping concert tickets, cluttering dating apps, and even spreading misinformation campaigns. “Every single time tickets go live, bots buy them up and drive prices sky-high,” he explained. “And on dating apps, you’ll come across an account with six fingers — that’s AI.”

But getting the public to trust a machine that scans your face and stores your identity? That’s a harder sell.

Already, privacy concerns have led to bans and investigations. Hong Kong blocked the project entirely. Regulators in the UK are probing it. Critics fear this is just another way for big tech figures like Altman to centralize power under the guise of innovation.

Once scanned, users receive a WorldID via a mobile app. Think of it like Face ID, but not tied to Apple — and theoretically usable across multiple platforms.

So far, WorldID has a limited number of use cases. Some Reddit communities and Shopify stores have “human-only” access points for verified users. Over 12 million people across 20+ countries have tried the Orb, which is available at malls, events, and soon — through a home delivery option starting in Latin America.

The Orb is temporarily unavailable in the U.S. while updates are underway. But the World App remains live.

The Orb’s identity system is tied to World, an open-source platform originally launched as Worldcoin in 2023. Users in some countries receive Worldcoin cryptocurrency for verifying their identity. (I didn’t — Worldcoin isn’t available in the U.S.)

The idea? To prepare for a world where AI transforms economies — and possibly distribute universal basic income, a concept Altman supports.

But giving users crypto in exchange for biometric scans raises red flags. Critics say it could encourage people to overlook privacy concerns, or hand over too much power to a handful of tech leaders.

Sada defends the model, saying World gives users ownership of the network — and that privacy is a core focus. According to Tools for Humanity, face scans are encrypted, sent to the user’s device, and then deleted. The app can also be locked for added security.

Much of the tech behind the Orb is open source, allowing external experts to examine its privacy protections.

“It’s not very intuitive that something like this is private,” Sada admitted. “But we believe privacy is freedom — and World is built to protect that.”

Source: CNN Newsource – Here’s what happened when I tried the Sam Altman-backed orb face scanner

The post I Tried the Face-Scanning Orb Backed by Sam Altman — Here’s What Happened appeared first on Journos News - Breaking News, World News, Top Stories, Todays Headlines and Flash Reports.

4chan, one of the internet’s most notorious forums, has gone dark following what appears to be a serious security breach.

According to outage tracker Downdetector, users began reporting issues late Monday night, with connection problems persisting into early Tuesday morning. While the homepage eventually became accessible after long load times, clicking on any internal links currently leads to a timeout—effectively rendering the site unusable.

Images shared on Imgur suggest a hacker gained shell access to 4chan’s hosting server. In a series of posts, they displayed screenshots of the site’s phpMyAdmin interface, revealing they had full backend access. The alleged attacker went further by doxxing the entire moderation team and leaking personal details of many registered users.

Alarming details have surfaced in the leak—several users reportedly signed up with their primary email addresses, some linked to .edu and even .gov domains, raising serious concerns about privacy and operational security.

The hacker also released portions of 4chan’s source code, highlighting security flaws that may have been present since Hiroyuki Nishimura took ownership of the site from founder Christopher Poole (aka moot). These vulnerabilities, now public, could take months to patch—assuming the site even recovers from this.

The breach has sparked speculation across Reddit and social media platforms, with some users suggesting this could mark the end of 4chan as we know it. If confirmed, it would represent one of the most significant deplatforming events for fringe online communities since Kiwi Farms faced a major takedown in 2022.

As of now, there’s been no official statement from 4chan administrators, and the forum’s future hangs in the balance.

Source: Engadget – 4chan, the internet’s most infamous forum, is down following an alleged hack

The post 4chan Taken Down by Alleged Hack, User Data Leaked appeared first on Journos News - Breaking News, World News, Top Stories, Todays Headlines and Flash Reports.

Cybersecurity officials from the FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have issued a warning about the Medusa ransomware, which has been active since 2021 and has recently impacted hundreds of individuals. citeturn0news18

What is Medusa Ransomware?

Medusa is a ransomware-as-a-service (RaaS) platform that first came to prominence in 2023. The ransomware impacts organizations running Windows, predominantly exploiting vulnerable and unpatched systems and hijacking accounts through initial access brokers. citeturn0search9

How Does Medusa Operate?

The Medusa ransomware gang has attacked over 300 victims in critical infrastructure sectors, according to U.S. cybersecurity agencies. citeturn0search5

Who Has Been Targeted?

Medusa has targeted over 300 victims in various sectors, including medical, education, legal, insurance, technology, and manufacturing. citeturn0news18

Recommended Protective Measures

To mitigate the risk of Medusa ransomware attacks, cybersecurity officials recommend the following actions:

• Update Systems Regularly: Ensure operating systems, software, and firmware are up-to-date to patch vulnerabilities.
• Enable Multifactor Authentication (MFA): Implement MFA for all services, especially webmail, VPNs, and accounts accessing critical systems.
• Use Strong Passwords: Employ long, unique passwords for all accounts and avoid password reuse.
• Educate Employees: Conduct regular training to recognize phishing attempts and suspicious activities.
• Secure Backups: Maintain offline, encrypted backups of critical data to ensure recovery without paying ransoms.

Implementing these measures can significantly reduce the risk of falling victim to Medusa ransomware attacks. Organizations are also urged to report any ransomware incidents to the FBI or CISA to aid in tracking and combating these threats.

Source: Cybersecurity officials warn against potentially costly Medusa ransomware attacks

The post Medusa Ransomware Warning: FBI and CISA Urge Caution appeared first on Journos News - Breaking News, World News, Top Stories, Todays Headlines and Flash Reports.

Elon Musk’s social media platform, X, suffered widespread outages on Monday, which the billionaire attributes to a cyberattack originating from Ukraine.

Musk’s Claim: A Coordinated Cyberattack?

During an interview with Fox Business on Monday afternoon, Musk stated:

“We’re not sure exactly what happened, but there was a massive cyberattack to try to bring down the X system, with IP addresses originating in the Ukraine area.”

However, Musk did not provide further details about the source of the attack or whether he believes it was linked to the Ukrainian government. Experts caution that cyber attackers often spoof IP addresses, making it difficult to determine the true origin of an attack.

Timeline of the Outage

According to outage-tracking site DownDetector:

• The issues began around 6 a.m. ET, with over 20,500 users reporting problems.
• The disruptions temporarily subsided but surged again at 10 a.m. ET, affecting nearly 40,000 users.
• By 2 p.m. ET, outage reports started decreasing, and service gradually resumed.

Users reported that X was inaccessible, and the issue appeared to be global, as DownDetector’s international platforms also showed disruptions. By 4 p.m. ET, Musk confirmed that the platform was functioning again.

Musk Hints at Larger Involvement

In a post on X, Musk suggested that “a large, coordinated group and/or a country is involved.” However, no conclusive evidence has been provided. He also responded “Yes” to a post speculating that the attack was an attempt to silence him and his platform.

Cybersecurity expert Eric Noonan, CEO of CyberSheath, urged caution in drawing immediate conclusions:

“One of the things that should always be taken with a grain of salt is any statements made in the short period immediately after, or even during, an attack.”

Musk’s History of Cyberattack Claims

This isn’t the first time Musk has attributed service disruptions to cyberattacks. In August 2024, his conversation with Donald Trump on X was delayed by 42 minutes, which Musk suggested was due to a likely distributed denial-of-service (DDoS) attack. Similarly, Ron DeSantis’ 2023 presidential campaign announcement on X was plagued by technical issues.

DDoS attacks overwhelm servers with excessive traffic, leading to service failures. However, ransomware attacks have been more prevalent in recent years due to their financial motives, whereas DDoS attacks typically aim to cause disruption, making their sources harder to trace.

Impact of Musk’s Leadership on X’s Stability

Since acquiring X (formerly Twitter) in 2022, Musk has made significant cuts:

• Immediately fired top executives upon taking over.
• Laid off 3,500 employees, roughly 50% of the workforce, within days.
• Reduced staff by 80% in total and enforced a return-to-office policy.

These drastic changes have coincided with frequent platform glitches and outages, raising concerns about the stability of the platform under Musk’s management.

A Tough Day for Musk’s Businesses

Beyond X, Musk faced setbacks in other ventures. Tesla shares plummeted 15% on Monday, erasing all gains since Trump’s November 2024 election. Additionally, Musk’s role as head of Trump’s Department of Government Efficiency (DOGE) has placed him under increased scrutiny.

This story is developing and will be updated as more details emerge.

Source

The post X Goes Down Worldwide – Musk Claims Cyberattack from Ukraine appeared first on Journos News - Breaking News, World News, Top Stories, Todays Headlines and Flash Reports.