Synthient credential stuffing data breach: what happened and what to do

What happened

Synthient is a threat-intelligence firm. During 2025 it collected credential-stuffing lists from several criminal sources. A credential-stuffing list is a giant file of email and password pairs taken from earlier breaches. Attackers feed it into login pages, betting that some people use the same password on more than one site.

Synthient partnered with Have I Been Pwned (HIBP), the free breach-notification service, to share what it had found. Have I Been Pwned added the data on 6 November 2025. It holds 1,957,476,021 unique email addresses, so "about 2 billion" is fair. HIBP lists the incident date as 11 April 2025.

Troy Hunt, who runs HIBP, wrote about the load. The data also contained 1.3 billion unique passwords, and CyberInsider reported that 625 million of those were new to HIBP's password list. The passwords are now searchable in Pwned Passwords, a tool that tells you whether a given password has shown up in a breach.

This is not one company's breach

Most entries on HIBP come from a single hacked company. This one doesn't. The email and password pairs come from many older breaches, repackaged. That has two consequences.

First, you can appear here without ever having an account at the company that originally leaked your data. Second, the passwords in the list were real ones people used somewhere, which makes them far more useful to an attacker than random guesses.

What was exposed

HIBP lists two types of data: email addresses and passwords. There are no names, phone numbers or payment details in the entry.

That is still enough to cause damage. An attacker takes your email and the password next to it and tries them on your email provider, your bank, shopping accounts, and social media. If the password matches, they get in. From a hijacked inbox they can reset passwords on other services, since most "forgot password" links go to your email.

A leaked email address also puts you on lists for phishing. The messages look more believable when the sender already knows an address and sometimes a password you really used.

What the company did

Synthient is not a company that was breached, so there was no incident response or notice to customers. Its role was to hand the collected data to HIBP so people could check their exposure. HIBP made it searchable and gave it a "verified" status in the database.

Who should worry

If you reuse passwords, you should worry. If every account has its own long, random password, a pair in a credential-stuffing list is mostly harmless: the password no longer opens anything.

Check the email addresses you use for important accounts, including old ones. An address you stopped using years ago can still be tied to a bank login or a cloud storage account.