Quick Summary
A database containing 149 million usernames and passwords, including 48 million Gmail and 17 million Facebook accounts, was discovered unsecured. The researcher Jeremiah Fowler reported the exposure, leading to its removal by the hosting provider. The database also included credentials for various platforms, government systems, and consumer banking, raising significant concerns about cybersecurity and privacy risks.
The Securityish Brief
A database with 149 million account usernames and passwords was found unsecured, including 48 million Gmail credentials, 17 million Facebook accounts, and 420,000 for Binance. Jeremiah Fowler, a security analyst, discovered the database and reported it to the hosting provider, which subsequently removed it for violating terms of service. The database was hosted by an affiliate in Canada, and Fowler noted that it continued to grow while he attempted to contact the provider over a month.
The exposed credentials included not only email and social media logins but also sensitive information from government systems, banking, and media streaming platforms. The structure of the database suggested it was designed for easy querying, indicating it might have been set up for cybercriminals to access various subsets of data.
Implications of the Exposure
This incident highlights the ongoing issue of unsecured databases that expose sensitive information. With the rise of infostealing malware, attackers can automate the collection of login credentials, making it easier for criminals to access vast amounts of data. Allan Liska from Recorded Future pointed out that renting such infrastructure could cost criminals as little as $200 to $300 a month, providing them access to hundreds of thousands of credentials.
The presence of credentials from various platforms, including 4 million Yahoo accounts, 1.5 million for Microsoft Outlook, and 3.4 million for Netflix, underscores the breadth of the exposure. Users should be aware that such leaks can lead to credential stuffing attacks, where stolen credentials are used to access accounts across multiple services.
Everyday users and organizations must remain vigilant about their online security practices. Monitoring accounts for unusual activity and enabling multi-factor authentication can help mitigate risks associated with credential theft. Additionally, organizations should regularly review their data security measures to prevent similar exposures.
Key Takeaways
- Regularly monitor your accounts for any unauthorized access or unusual activity.
- Enable multi-factor authentication on your accounts to add an extra layer of security.
- Change passwords for any accounts that may have been exposed in the breach.
- Be cautious of phishing attempts that may arise from leaked credentials.
- Consider using a password manager to generate and store strong, unique passwords for each account.
Key Terms & Concepts
- Infostealer Malware: In this article, infostealer malware refers to malicious software that collects sensitive information, such as login credentials, from infected devices.
- Keylogging: Keylogging is a technique used by malware to record the keystrokes of users, capturing sensitive information they type into websites.
Read the original article here: https://www.wired.com/story/149-million-stolen-usernames-passwords/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
