Massive Database Exposes 149.4M Stolen Credentials

A cybersecurity researcher has uncovered a massive unencrypted database exposing 149.4 million unique usernames and passwords, including credentials for 48 million Gmail accounts, raising alarms about widespread risks to online security.

Jeremiah Fowler discovered the 96-gigabyte repository while scanning publicly accessible servers. The data, which included emails, passwords and direct links to login pages for various services, was entirely unprotected and available to anyone with a web browser. It encompassed logins for 17 million Facebook accounts, 6.5 million Instagram profiles, 3.4 million Netflix users and 4 million Yahoo accounts, among others. Financial platforms were also hit, with over 420,000 Binance credentials exposed, alongside banking details, cryptocurrency wallets and credit card information. More concerning, the database contained government domain logins from multiple countries, potentially enabling spearphishing or network intrusions.

The exposure lasted nearly a month before the hosting provider suspended access, following repeated notifications from Fowler. During that time, the database grew in real time, indicating ongoing activity from malware collecting...