149,000,000 Passwords Exposed Online As Hackers Hit Users of Google, Facebook, Instagram and Other Major Platforms: Report

A cybersecurity researcher says he discovered a massive data leak that compromised the online credentials of millions of internet users. 

Jeremiah Fowler says a database containing more than 149 million unique logins and passwords totaling 96 GB of raw credential data have been exposed online.

In a report published by ExpressVPN, Fowler says he found scores of sensitive information in a small slice of the data.

“In a limited sampling of the exposed documents, I saw thousands of files that included emails, usernames, passwords, and the URL links to the login or authorization for the accounts. This is not the first dataset of this kind I have discovered and it only highlights the global threat posed by credential-stealing malware. When data is collected, stolen, or harvested it must be stored somewhere and a cloud based repository is usually the best solution.”

Fowler says the database was not password-protected or encrypted. It was also publicly accessible, and anyone who discovered it could access the credentials of the affected individuals.

“It is not known how long the database was exposed before I discovered and reported it or others may have gained access to it. One disturbing fact is that the number of records increased from the time I discovered the database until it was restricted and no longer available.”

According to Fowler, the exposed records belong to users of popular internet services, including Gmail, Yahoo, Outlook, iCloud, Facebook, Instagram, TikTok, Netflix, Binance and OnlyFans. He also discovered credentials with .edu and .gov domains.

“Exposed government credentials could be potentially used for targeted spear-phishing, impersonation, or as an entry point into government networks. This increases the potential of .gov credentials posing national security and public safety risks.”

Generated Image: Midjourney