A massive, unprotected trove of stolen credentials believed to contain roughly 149.4 million unique username–password pairs — including tens of millions tied to major email and social platforms — was discovered by security researcher Jeremiah Fowler and remained publicly accessible for weeks before a hosting provider suspended the repository.
Background
The dataset was first disclosed in a report published by ExpressVPN, authored by Fowler, who says the repository contained 149,404,754 unique log lines and about 96 GB of raw credential data. The exposed records purportedly included email accounts, social media logins, streaming services, financial and crypto accounts, and even entries tied to .gov and .edu domains. Fowler asserts the collection appeared to be indexed and searchable with a standard web browser, and that the exposed records grew while he attempted to get the host to take the database offline.
This was not presented as a breach of any single provider (Google, Meta, Netflix, etc.), but rather as an aggregation of credentials — likely compiled from multiple sources, including the output of “infostealer” malware on infected devices and previously published dumps. At least two independent reporting outlets corroborated Fowler’s basic findings and the estimated counts for high-profile services such as Gmail and Facebook.
What the trove reportedly contained
The researcher’s sample-based analysis produced a breakdown of the most notable categories and counts, which have been widely repeated by multiple outlets:
- Total unique logins and passwords: 149,404,754 (about 96 GB of raw data).
- Email platforms: an estimated 48 million Gmail entries, ≈4 million Yahoo, ≈1.5 million Microsoft Outlook/Hotmail, and ≈900,000 Apple iCloud accounts.
- Social media and streaming: about 17 million Facebook logins, 6.5 million Instagram, 3.4 million Netflix, 780,000 TikTok, and an estimated 100,000 OnlyFans entries.
- Financial and crypto: rough counts include ~420,000 Binance-related logins and unspecified numbers tied to banking and trading accounts.
- Academic, government, and other: about 1.4 million “.edu” accounts and multiple entries linked to .gov domains from several countries. Fowler warned that even limited access to some government-linked accounts could enable targeted spear-phishing or impersonation.
Multiple reporting outlets independently repeated these high-level numbers, indicating that the public disclosure by Fowler was consistent and widely vetted by the cybersecurity press. That said, the counts are based on sampling and classification of filenames/paths rather than confirmed, provider-issued breach reports. Where data provenance is unclear, the exact degree of exposure for any particular service or user cannot be guaranteed.
How the data was likely gathered
The technical characteristics of the repository — automated indexing, unique record hashes, and the presence of direct login URLs — are consistent with collections produced by
infostealer malware. Infostealers operate on infected endpoints and harvest credentials by capturing keystrokes, form data, cookies, and stored browser credentials, then exfiltrate that data to a server where it is aggregated and indexed for resale or direct abuse. Fowler’s report and subsequent technical coverage observed many indicators consistent with this model.
Researchers noted the repository’s structure suggested it was intended for programmatic searching and filtering — behavior consistent with criminal marketplaces that offer customers the ability to query large sets of stolen credentials by service, domain, or country. Because these aggregations can be built from multiple incidents over time, a large exposed set does not necessarily mean one single breach of a major provider; it often reflects
many smaller captures stitched together.
Why this matters: threats and attack paths
The exposed data poses several clear and practical threats for individuals and organizations:
- Credential stuffing and account takeover: Automated tools can attempt leaked username–password pairs across dozens of services. Users who reuse credentials are at highest risk. Successful reuse-based attacks can lead to email compromise, financial fraud, or takeover of social accounts.
- Spear-phishing and targeted scams: Because exposed records can include the exact login URLs and real email addresses or usernames, attackers can craft highly convincing phishing messages and prefill context that makes fraud appear legitimate. Government and academic entries increase the potential impact of targeted campaigns.
- Chaining attacks: Access to email accounts is particularly valuable; control of an inbox enables password resets for other services, facilitating lateral takeover of financial or business accounts. Attackers often combine leaked credentials with social engineering to escalate privileges.
- Privacy and extortion: Streaming, dating, and subscription platforms can provide personal or financial details usable for blackmail, doxxing, or the sale of sensitive content tied to the account holder.
- State and infrastructure risk: Entries tied to government domains may allow attackers to impersonate officials, mount targeted intrusions, or obtain further privileged access through social engineering and credential reuse. The presence of such entries elevates the public-interest angle of the leak.
Multiple reputable outlets emphasized that even if the dataset was assembled from older breaches or multiple sources, the threat remains real because attackers can automate abuse and target any accounts still using the leaked credentials.
The discovery and takedown timeline
According to Fowler’s account, he discovered the open repository and reported it through the hosting provider’s abuse channels. The host initially deflected responsibility, explaining the IP was managed by an affiliate; after roughly a month and repeated contact the hosting provider suspended access and removed the dataset from public view. Fowler also emphasized he responsibly avoided downloading the data and limited his interaction to screenshots and reporting.
Several outlets verified the timeline and noted a troubling reality: misconfigured or malicious cloud storage frequently remains discoverable for weeks, allowing third-party indexing, copying, and reuse. The fact that the exposed records continued to increase during the reporting period suggests the collection remained actively fed by infected devices while accessible. That behavior raises the risk that others scraped or replicated the data before takedown.
What is known and what is not
What we can say with reasonable confidence:
- A large, searchable credential dataset existed and was publicly accessible.
- The dataset contained millions of records tied to major email, social, and streaming services, as reported by the researcher and corroborated by independent reporting.
- The repository’s structure and content are consistent with infostealer-derived aggregations.
What remains unverified or uncertain:
- Whether the dataset represents fresh compromises of the named providers or merely an aggregation of older leaks and malware harvests; many credential collections are composite by design. Presenting counts as absolutes risks overstating recency or single-source responsibility. This nuance matters for breach notifications and legal obligations tied to provider-side compromises.
- Who owned, operated, or initially uploaded the repository; the hosting provider declined to disclose ownership details to the researcher.
- Whether third parties copied the dataset before takedown — possible and likely, but not provable without forensic evidence. Users should assume compromise is possible and take protective action.
Immediate steps for individuals — short checklist
If you use any of the affected services or are concerned you may be impacted, do the following now:
- Check account activity and sessions: Review login history, active sessions, and devices for Gmail, Outlook, Facebook, and other services. Sign out of any sessions you don’t recognize.
- Change reused passwords immediately: For any account where you reused the password listed in other services, change to a unique passphrase. Prioritize email, banking, and cloud-storage accounts first.
- Enable strong multi-factor authentication (MFA): Prefer hardware keys or app-based OTPs where supported; SMS-only MFA is better than nothing but less secure than an authenticator app or security key.
- Use a reputable password manager: Generate and store unique, complex passwords. Password managers also reduce exposure to keyloggers by autofilling credentials in many cases.
- Scan and clean devices: Run up-to-date antivirus/endpoint detection and response tools and consider reimaging any device where you suspect infection; changing a password on an infected machine may result in immediate recollection of the new password.
- Revoke third-party app access and reset tokens: For services that offer OAuth tokens or connected apps, revoke and reauthorize trusted apps as needed.
These actions are both defensive and proactive: attackers exploit old and new credentials alike, so assuming a worst-case posture until you are satisfied you are clean is prudent.
Practical steps for enterprises and IT teams
Organizations face an elevated risk when employees reuse credentials or access corporate resources from infected endpoints. Corporate defenders should:
- Enforce password hygiene and MFA across all enterprise services, with hardware-backed MFA for privileged access.
- Deploy endpoint detection and response (EDR) and ensure antivirus signatures are current; implement threat-hunting routines for infostealer indicators.
- Harden cloud storage and logging: scan buckets and databases for public access, enable object-level encryption and access logging, and automate alerts for misconfigurations. The incident highlights the real-world consequences of misconfigured cloud hosts.
- Rotate credentials and revoke tokens after confirmed exposures: treat any account that might have used a leaked credential as suspect and require forced resets and token invalidation.
- Adopt least-privilege and zero-trust principles to reduce the blast radius of any compromised account.
Enterprises should also prepare communications and incident-response playbooks that anticipate credential harvesting patterns, since infostealer campaigns can persist for extended periods.
Critical analysis — strengths in the disclosure and weak points
Strengths:
- Responsible reporting: The researcher contacted the hosting provider and limited interaction with the dataset rather than downloading it, which is a responsible disclosure practice. That behavior preserved evidence and limited secondary spread from the researcher’s actions.
- Clear technical indicators: Fowler documented the dataset structure, unique hashing of lines, and other artifacts that help security teams understand likely infostealer-based origins and how to detect similar repositories. Multiple outlets confirmed these technical features.
- Public awareness: The disclosure prompted widespread coverage and practical guidance for users at a scale that could deter opportunistic credential reuse by attackers.
Limitations and risks:
- Attribution and recency are unclear: The dataset’s provenance remains uncertain. Without provider confirmation or deeper forensic analysis, it is impossible to determine which credentials are newly stolen versus rehashed from older breaches. Reporting sample counts as definitive may inadvertently overstate impact. Readers should treat counts as indicative rather than absolute.
- Data replication risk: Any publicly accessible repository can be copied. Even though the host took action, copies of the dataset may already exist in private criminal markets, making retroactive containment impossible.
- Potential for panic or fraudulent notifications: Publicized leaks sometimes spawn scams where attackers contact users claiming to be "remediation teams." Security comms must be clear to avoid enabling social-engineering attacks under the guise of help.
Overall, the disclosure shines a light on persistent operational issues: attackers rely on scale and automated pipelines, while cloud misconfigurations and slow abuse responses keep stolen data accessible longer than they should be.
Responsible follow-up and what to watch for
Users and administrators should watch for:
- Unusual login attempts across services, especially from new regions or IP ranges. Configure alerts where available.
- Credential-stuffing waves against major providers; abnormal outbound fraud attempts can be an early indicator that leaked data is being exploited.
- Phishing campaigns leveraging real account metadata. Attackers who possess valid credentials can craft convincingly customized messages.
Security teams should prioritize hygiene: password rotation for high-value enterprise users, enforcement of MFA, and rapid incident response for any confirmed account takeovers. Hosting providers should re-evaluate abuse reporting mechanisms and consider human review to accelerate takedowns of clearly malicious infrastructure.
Practical, prioritized checklist — 10 actions to take in the next 24–72 hours
- Review email account sign-in activity and sign out all sessions you don’t recognize.
- Change passwords for any account where you reused the same or similar password.
- Enable MFA on all major accounts; prefer app-based authenticators or hardware security keys.
- Run a full malware and antivirus scan on every PC and mobile device; reimage devices you believe may be compromised.
- Revoke third-party app authorizations and OAuth tokens for sensitive services.
- Turn on account recovery notifications where available.
- Use a password manager to generate and store unique passwords.
- Freeze or monitor credit if you see financial accounts exposed or suspect identity theft.
- For businesses, enforce password resets and require MFA for privileged users.
- Report any suspected fraud to your bank and to the affected service’s abuse team; keep records of communications.
Final assessment
This disclosure is a stark reminder that credential theft is a large-scale, automated business. Whether the dataset represents new intrusions or an aggregation of older captures, the risk to users who reuse passwords or lack robust authentication remains acute. The technical details suggest infostealer malware and a marketplace-style repository, which means opportunistic abuse and resale are likely consequences even after the public copy was removed.
Protection measures are straightforward and effective when implemented at scale: unique passwords, modern multifactor authentication (preferably hardware-backed), up-to-date endpoint security, and cloud hardening can materially reduce risk. For hosting providers and cloud platforms, the incident also underlines the imperative for faster, human-reviewed abuse processes and better detection of repositories holding clearly malicious or stolen data.
Assume compromise is possible and act decisively: check account activity, update credentials where necessary, enable MFA, and clean devices. Those steps remain the best defense against credential-based attacks whether an exposure is new, aggregated, or old.
Source: AOL.com
Nearly 150 Million Email, Social Accounts Could Be Affected by ‘Stolen Passwords’ — What to Know, and How to Protect Yourself