# 16 billion passwords leaked: how we protect our clients' passwords > After the leak of 16 billion passwords: how impaktfull keeps client passwords safe with 1Password vaults and roles, and what you can do today, passkeys and 2FA included. By Koen Van Looveren, impaktfull · Published 2025-06-19 · Updated 2026-11-07 Source: https://www.impaktfull.com/blog/16-billion-passwords-leaked-how-impaktfull-protects-its-client-passwords Imagine waking up to find out that **16 billion** usernames and passwords have just been leaked online. That’s not a plot from a bad hacker movie, it’s real, it’s massive, and it’s happening right now. While the internet scrambles to change passwords and tighten security, here at **impaktfull**, we’re breathing a little easier. Why? Because we’ve built our password management like we build our products: **smart, structured, and secure**. ## 🔥 The Biggest Password Leak in History In June 2025, cybersecurity researchers uncovered a **massive leak of over 16 billion login credentials**, affecting services like Apple, Google, Facebook, GitHub, and more. Unlike previous breaches, this dataset consists largely of **new and unreported credentials**, making it particularly dangerous. The leak is believed to be the result of **infostealer malware** and **misconfigured cloud environments**, with credentials sold or shared on the dark web. Experts are calling it a **“blueprint for mass exploitation,”** highlighting how urgent and critical password security has become for individuals and organizations alike. At **impaktfull**, we’ve been preparing for moments like this from day one. ![](https://www.impaktfull.com/images/blogs/16-billion-passwords-leaked-how-impaktfull-protects-its-client-passwords/forbes.webp) *Forbes article* ## 🔐 Security Starts With Smart Habits And the Right Tools We work on platforms and apps that handle user data, business-critical APIs, and third-party integrations. That’s why **password hygiene isn’t optional for us, it’s built into our company culture**. Here’s how we do it: ### ✅ We use 1Password but with intention 1Password is more than just a vault for us it’s a **secure operating system**. - **Every projects or part of the company** (development, operations, business, events) has a **dedicated vault**. - Vaults are organized in a way that only people needing access to the vault will receive access. - Each password is **strong, unique, and never reused** generated and stored automatically. - 1Password is also part our our CI/CD by using our own [impaktfull_cli](https://www.impaktfull.com/blog/the-power-of-custom-clis) ### ✅ Role-based access control Not every employee needs access to every credential. With 1Password: - Access is **tied to responsibilities** - We can **onboard and offboard** team members in minutes, without ever losing control of sensitive information. ### ✅ We Review and Revoke Regularly, we **audit our vaults**, clean up unused credentials, and remove access where it’s no longer needed. If someone leaves the team, their vault access is revoked instantly. ## 🛡️ Watchtower: Our Always-On Guard 1Password’s **Watchtower** acts like an automated breach-radar. Every time a new public data leak is reported, Watchtower cross-checks the (securely hashed) fingerprints of our stored logins against the breach database powered by *Have I Been Pwned?*. If a match pops up, the whole team sees an instant red warning banner inside 1Password and receives an email alert. That means we know **within minutes** when a password, 2FA secret, or credit-card number has been exposed and can rotate the credentials before attackers even try them. It’s proactive, friction-free, and fits perfectly with our “change-fast, stay-safe” mindset. ![](https://www.impaktfull.com/images/blogs/16-billion-passwords-leaked-how-impaktfull-protects-its-client-passwords/watchtower.webp) *impaktfull watch tower score* ## 🚨 Why This Approach Matters Now More Than Ever The recent leak shows just how dangerous the current landscape is: - Hackers aren’t manually guessing passwords, they’re feeding billions of leaked credentials into bots. - Once they access one account (your email, for example), they can **chain-access** everything else. - Reused passwords are like duplicate keys, lose one, and they all open. That’s why using **a password manager + structured permissions** isn’t just a “tech team thing.” It’s a company-wide requirement. ## 💡 What You Can Do Today If you’re reading this as a freelancer, founder, or team lead, here are 7 things you can do right now: 1. **Stop reusing passwords** even “slightly different” ones. 2. **Start using a password manager** like 1Password. 3. **Create separate vaults** for teams or projects. 4. **Limit access** based on roles follow the principle of least privilege. 5. **Use passkeys** where a service offers them: there is no password to leak or to phish. 6. **Turn on 2FA** on every account that offers it. 7. Check on [https://haveibeenpwned.com](https://haveibeenpwned.com/) if your email has been found in any known databreaches ![](https://www.impaktfull.com/images/blogs/16-billion-passwords-leaked-how-impaktfull-protects-its-client-passwords/have-i-been-pwned.webp) *No databreaches for my impaktfull email* ## Final Thoughts At impaktfull, we don’t wait for breaches to happen before acting. We proactively secure our tools and platforms so we can focus on what we do best building meaningful, impactful digital products. Security isn’t a feature it’s a foundation. And with structured tools like 1Password and a team that takes privacy seriously, we’re confident in the systems we’ve built. If you’re not yet thinking about password security, **now is the time**. Sources: - [Forbes: 16 Billion Apple, Facebook, Google And Other Passwords Leaked](https://www.forbes.com/sites/daveywinder/2025/06/19/16-billion-apple-facebook-google-passwords-leaked---change-yours-now/) - [Forbes: Google asks 2 billion users to change your password](https://www.forbes.com/sites/daveywinder/2025/06/16/change-your-gmail-password-now-google-tells-2-billion-users/) Want to know how the apps and platforms you run handle passwords, keys and secrets? We check that in a [security health check](https://www.impaktfull.com/service/health-checks). --- impaktfull builds and runs apps, websites, platforms and AI agents, from Antwerp, Belgium. More at https://www.impaktfull.com.