A publicly accessible database containing 149 million stolen usernames and passwords was discovered online by a cybersecurity researcher, before being taken down by the hosting provider, according to multiple reports.
The dataset was identified by researcher Jeremiah Fowler, who alerted the provider after finding the records exposed without authentication. While the database is no longer accessible, security specialists said such discoveries often come after the data has already circulated among cybercriminals.
The trove included credentials linked to major online services, including around 48 million Gmail accounts, 17 million Facebook logins and 6.5 million Instagram records. Other entries were associated with platforms such as Yahoo, Netflix, Microsoft Outlook, Apple iCloud, TikTok and Binance.
Security experts said the incident does not point to a single breach at any one company, but reflects how credentials are routinely harvested through malware infections on users’ devices.
“This is not a breach in the traditional sense, and it is not evidence of a single failure,” said Shane Barney, chief information security officer (CISO) at Keeper Security. “It is the byproduct of an ecosystem that continuously harvests credentials from endpoints and quietly accumulates access over time.”
Barney said malware known as infostealers typically captures whatever credentials a user enters once a device is compromised, which explains why records from consumer platforms, financial services and other systems often appear together.
“Once a device is compromised, everything the user touches becomes part of the collection process,” he said. “The value for attackers is not any one account, but the ability to reuse access and move within organisations without drawing attention.”
While the database has been removed, Barney said such actions do little to reduce risk if stolen credentials remain active.
“Taking a dataset offline does nothing to address the underlying issue, which is that many of these credentials remain valid long after they have been stolen,” he said.
Cybersecurity professionals increasingly caution that password leaks should be treated as a constant condition rather than isolated incidents. According to Barney, organisations need to assume that credentials will be exposed and design controls accordingly.
“The question is no longer how to stop every theft,” he said. “It is how access is limited once attackers arrive already authenticated.”
