Headline: Exposed Database With 149 Million Credentials Taken Offline

A large unprotected database containing millions of user credentials was discovered and subsequently removed after being reported to the hosting provider. The incident involved a wide range of online services and highlights the scale of exposed personal data.

Cybersecurity researcher Jeremiah Fowler identified the database, which was accessible to the public and searchable through a web browser. The database remained online for nearly a month before it was taken down by the hosting provider following the report.

The database contained approximately 149 million unique usernames and passwords. It included login information for various platforms, with a notable concentration of Gmail and Facebook accounts among the exposed data.

In addition to Gmail and Facebook, the dataset featured credentials for services such as Yahoo, Outlook, iCloud, academic email domains, TikTok, OnlyFans, Netflix, and Binance. The data was not encrypted and continued to expand during the period it was left online.

What the numbers show

• 149 million unique usernames and passwords were exposed
• 48 million Gmail account credentials were included
• 17 million Facebook account credentials were present

The exposed credentials were compiled from various sources and appeared to have been collected using infostealer malware. According to the researcher, the malware harvested login details from infected devices through methods such as keylogging.

The database’s accessibility allowed anyone with a web browser to search for account information. Over the course of a month, the number of records in the database increased before its removal.

The incident involved a range of online platforms, affecting both personal and institutional accounts. The presence of academic and financial service credentials highlights the broad scope of the breach.

After the discovery, the hosting provider acted on the report from the cybersecurity researcher and took the database offline. The takedown ended public access to the exposed credentials, but the duration of exposure raised concerns about the potential misuse of the information.

* This article is based on publicly available information at the time of writing.