InfoSecBulletin Cybersecurity for mankind
Cybersecurity researcher Jeremiah Fowler discovered a data leak containing 149 million logins and passwords. The database was publicly accessible without password protection or encryption, holding 149,404,754 unique credentials totaling 96 GB.
The leaked records contained usernames and passwords from victims worldwide, covering various online services and accounts. These included social media platforms like Facebook, Instagram, TikTok, and X (formerly Twitter), along with dating sites and OnlyFans accounts for both creators and customers.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
The researcher found many streaming and entertainment accounts like Netflix, HBOmax, DisneyPlus, and Roblox, along with financial services accounts, crypto wallets, and banking logins.
The presence of .gov credentials from various countries raises concerns. Even if not all government accounts provide access to sensitive systems, any access can be risky based on the user’s role. Exposed government credentials can lead to spear-phishing, impersonation, or unauthorized entry into networks, posing national security and public safety threats.
The dataset is now inaccessible after multiple attempts. The hosting provider refused to provide details about the database management, leaving it unclear if it was linked to criminal activity or legitimate research, or why it was publicly exposed.
Potential Risks of Exposed Credentials:
The leak of many unique logins and passwords poses a serious security threat. Criminals could automate attacks using this data, targeting accounts across emails, financial services, social networks, and businesses.
How to Protect Your Accounts, Credentials, and Privacy:
The researcher suggested updating the operating system and security software (if installed). If you don’t have security software, install it and scan the device to remove anything that is identified as malicious or flagged as suspicious.
