2.5 billion users at risk