2 Billion Email Addresses Were Exposed, and We Indexed Them All in Have I Been Pwned

This post describes Have I Been Pwned's ingestion and verification of the Synthient credential-stuffing corpus—approximately 1.96 billion unique email addresses and 1.3 billion unique passwords aggregated from criminal sources—outlines verification examples showing real reused and active passwords, explains technical challenges loading and notifying affected users, and provides mitigation advice (use password managers, unique passwords, MFA, and passkeys).