It sounds like these sites might be making headlines on a technicality:

"Researchers claim that most of the data in the leaked datasets is a mix of details from stealer malware, credential stuffing sets, and repackaged leaks.

There was no way to effectively compare the data between different datasets, but it’s safe to say overlapping records are definitely present. In other words, it’s impossible to tell how many people or accounts were actually exposed."

So what they're actually saying is that in the last 6 months they've found 30 exposed databases which are not exact copies of any pre-existing leak, totaling 16 billion records before deduplication and removal of already-leaked records.