184,000,000 Usernames and Passwords Exposed in Extraordinary Data Breach – Apple, Microsoft, Meta, Google, Netflix, Spotify, Discord, Roblox and PayPal Users Affected: Report

A veteran cybersecurity researcher says he’s discovered a secret database containing the login credentials for over 184 million accounts across numerous platforms.

Data-breach hunter Jeremiah Fowler says he has found an unprotected database of exactly 184,162,718 login records across more than 47 GB of data.

Fowler says that judging on the size and the scope of the database, it may be some kind of compilation, either kept by researchers investigating a data breach or other criminal activity, or possibly directly owned by data thieves themselves who acquired the credentials using malware.

“Knowing the login and passwords of millions of accounts is a dream come true for cyber criminals — they probably have a long list of how exposed credentials and emails could be exploited.”

Fowler says a small sample of records he analyzed contained 479 Facebook accounts, 475 Google accounts, 240 Instagram accounts, 227 Roblox accounts, 209 Discord accounts, and more than 100 each of Microsoft, Netflix, and PayPal accounts.

The sample also included Amazon, Apple, Nintendo, Snapchat, Spotify, X, WordPress, Yahoo, and many other types of login info, reports Wired.

With the scope of information that was exposed, Fowler says the victims are now vulnerable to several kinds of attacks, including corporate espionage, phishing and social engineering, account takeovers, and more.

He also mentions that government entities appeared to be included in the hack.

“I saw numerous .gov accounts from countries around the world. These could be a serious potential risk if any of those compromised accounts had security clearance to sensitive areas of the state networks or data.”

The exact origins of the database are unknown, but Fowler notes that the password field was labeled as “Senha,” which is “password” in Portuguese.

Fowler says he believes it’s “highly possible” that a cybercriminal is to blame, calling it the only reasonable explanation for the massive collection of login data.

Generated Image: Midjourney

Source