Credential‑Stuffing Dataset Exposes Nearly 2 Billion Email‑Password Pairs
What Happened
During 2025, threat‑intelligence firm Synthient aggregated ≈ 2 billion unique email addresses and ≈ 1.3 billion passwords from multiple historic breaches. The compiled list—now searchable via Have I Been Pwned—covers 1,957,476,021 accounts and is being used to fuel credential‑stuffing attacks against unrelated services.
Why It Matters for Compliance & Audit Readiness
- Continuous control‑assurance programs that enforce strong password policies and MFA can demonstrate compliance with NIST 800‑63B and ISO 27001 A.9.2, reducing the likelihood of credential‑stuffing success.
- Real‑time monitoring for compromised credentials (e.g., via HIBP API) provides defensible evidence for audit trails and supports the “Detect” function of the NIST CSF.
- Documented remediation of reused passwords and proof of remediation actions satisfy regulator‑mandated risk‑mitigation reporting (e.g., GDPR Art. 32, PCI‑DSS Req 8.3).
Who Is Affected
- SaaS platforms with consumer‑facing accounts
- Financial services & fintech applications
- Healthcare portals & patient‑facing systems
- Educational institutions & learning management systems
- Any organization that stores user‑generated passwords without enforced MFA
Recommended Actions
- Review all credential stores for password‑reuse patterns; enforce unique, high‑entropy passwords.
- Validate that MFA is mandatory for privileged and high‑risk user groups.
- Deploy continuous monitoring of compromised‑credential feeds (e.g., HIBP API) and integrate alerts into SIEM.
- Update incident‑response playbooks to include credential‑stuffing detection and rapid password‑reset processes.
- Document the above controls and evidence in your audit artifacts.
Technical Notes
- Attack vector: Credential stuffing using reused passwords harvested from historic breach dumps.
- CVEs: None reported (the threat is operational, not software‑vulnerability‑based).
- Data types exposed: Email addresses, plaintext passwords (or password hashes that can be cracked).
Source: https://haveibeenpwned.com/api/v3/breach/SynthientCredentialStuffingThreatData