A 96GB database containing more than 149 million logins and passwords was recently discovered by respected cybersecurity researcher Jeremiah Fowler. The findings, which ExpressVPN published in its research blog, lay out Fowler's findings in detail.
The data, which was openly accessible to anyone who knew where to find it, was full of usernames and passwords from people all over the world. Estimates place email credentials at the top of the list of leaks, with Gmail alone taking up 48 million entries. Outlook is on the list with 1.5 million leaks. Yahoo, iCloud, and .edu addresses make up more than 6 million leaks.
Fowler lists Facebook, Instagram, TikTok, OnlyFans, HBO Max, Disney+, Roblox, Binance, and X (aka Twitter) as other notable accounts discovered in the exposed database.
The exposed records included usernames and passwords collected from victims around the world, spanning a wide range of commonly used online services and about any type of account imaginable.
Cybersecurity researcher Jeremiah Fowler
It gets worse. Financial accounts, including crypto wallets, banking, and credit card credentials, were also spotted in the limited sample that Fowler viewed. The presence of .gov domain credentials from "numerous countries" has Fowler concerned about national and public safety; this sort of info can be used as an entry into protected government networking.
That's a wide enough swath that practically anyone plugged into the internet could be exposed. Here's a quick estimation of Fowler's findings:
- Gmail — 48 million
- Yahoo — 4 million
- Outlook — 1.5 million
- .edu — 1.4 million
- iCloud — 900,000
- Facebook — 17 million
- Instagram — 6.5 million
- Netflix — 3.4 million
- Binance — 420,000
- OnlyFans — 100,000
It's important to note that this database isn't the result of a single data breach or a targeted attack by hackers on one site. This is a gargantuan collection of credentials and other sensitive documents gathered over time by malware.
As Fowler explains it, data that is stolen has to be kept somewhere, and cloud storage is usually the first choice. It piles up over time, evidently harvesting from numerous sources. The hackers who originally had hold of the data were likely subject to their own data breach, which resulted in the database's open doors.
It's noted that the database isn't tied to any ownership; Fowler reported the breach to the cloud provider, but quickly hit a dead end due to the IP being a subsidiary acting under the provider's umbrella and name.
Fowler spent "nearly a month" involving "multiple attempts" before he was able to get the exposed database taken offline. There's no indication as to how long this database was being fed with stolen data, but Fowler notes that its records continued to increase right up until it was taken offline.
As I noted when I covered one of Fowler's previous discoveries involving 40 billion unencrypted records, use strong passwords (ideally through a password manager), never use the same password twice, and use multi-factor authentication to prevent access should a bad actor indeed get their hands on your credentials.
(via Tom's Guide)
What are you doing to protect yourself against data breaches like this? Let me know in the comments section!
Follow Windows Central on Google News to keep our latest news, insights, and features at the top of your feeds!
