InfoSecBulletin Cybersecurity for mankind
Cybersecurity researcher Jeremiah Fowler discovered a data leak containing 149 million logins and passwords. The database was publicly accessible without password protection or encryption, holding 149,404,754 unique credentials totaling 96 GB.
The leaked records contained usernames and passwords from victims worldwide, covering various online services and accounts. These included social media platforms like Facebook, Instagram, TikTok, and X (formerly Twitter), along with dating sites and OnlyFans accounts for both creators and customers.
NetamLoader malware to attack Win10: Customized for Gov.t in Asia
‘SMS of Death’ Zero-Click Flaw Disrupting Android Phones With a Single Text
NIST Unveiled Guidance for Post-Quantum Cryptography Transition
Daily Cyber security update for 29.10. 2026
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The researcher found many streaming and entertainment accounts like Netflix, HBOmax, DisneyPlus, and Roblox, along with financial services accounts, crypto wallets, and banking logins.
The presence of .gov credentials from various countries raises concerns. Even if not all government accounts provide access to sensitive systems, any access can be risky based on the user’s role. Exposed government credentials can lead to spear-phishing, impersonation, or unauthorized entry into networks, posing national security and public safety threats.
The dataset is now inaccessible after multiple attempts. The hosting provider refused to provide details about the database management, leaving it unclear if it was linked to criminal activity or legitimate research, or why it was publicly exposed.
Potential Risks of Exposed Credentials:
The leak of many unique logins and passwords poses a serious security threat. Criminals could automate attacks using this data, targeting accounts across emails, financial services, social networks, and businesses.
How to Protect Your Accounts, Credentials, and Privacy:
The researcher suggested updating the operating system and security software (if installed). If you don’t have security software, install it and scan the device to remove anything that is identified as malicious or flagged as suspicious.
