Top News

A massive cybersecurity revelation has sent shockwaves across the internet after nearly 149 million unique usernames and passwords were found exposed on an unsecured online server. The leaked data includes logins linked to popular email services, social media platforms, streaming apps, financial services, cryptocurrency exchanges, and even government domains.

What makes this incident especially alarming is that it was not the result of a traditional hacking attack. Instead, cybersecurity researcher Jeremiah Fowler discovered that the data was collected using infostealer malware, a silent but dangerous threat that steals sensitive information directly from infected devices.

What Was Found in the Data Leak

According to Fowler’s findings, the exposed database contained around 149,404,754 unique login credentials, with a total size of approximately 96GB. The server had no password protection and no encryption, meaning anyone with access to the link could view or download the information freely.

The discovery was shared publicly through cybersecurity channels, raising urgent concerns about user privacy and digital safety.

Which Platforms Were Affected

The leaked credentials span across almost every major category of online services:

Social Media and Online Platforms

Accounts linked to widely used platforms such as Facebook, Instagram, X (formerly Twitter), TikTok, and other social networks were found in the dataset. In addition, credentials related to gaming and entertainment platforms were also present.

Streaming Services

A significant number of streaming accounts were exposed, including:

• Netflix (approximately 3.4 million accounts)

• HBO Max

• Disney Plus

• Roblox

Exact figures for all platforms were not disclosed, but researchers confirmed widespread exposure.

Email Accounts

Email services were heavily impacted, including:

• Around 48 million Gmail accounts

• Nearly 4 million Yahoo accounts

• About 1.5 million Outlook accounts

Since email accounts often act as recovery points for other services, this significantly increases the overall risk.

Financial and Government-Related Data

The most serious concern is the exposure of:

• Roughly 420,000 Binance accounts

• Online banking login credentials

• Cryptocurrency wallet details

• Usernames and passwords associated with government (.gov) domains across multiple countries

How Did This Data Leak Happen

Jeremiah Fowler explained that the data was likely harvested using infostealer malware. This type of malware infiltrates devices silently and captures saved passwords, browser data, cookies, and other sensitive information.

Once collected, the stolen data is usually stored on cloud servers for later use or sale. In this case, the server itself was left completely unsecured—ironically turning cybercriminals into victims of their own poor security practices.

Was the Data Available Online for Long

Fowler reportedly notified the hosting provider immediately after discovering the exposed database. However, it took nearly one month for the server to be taken offline. During this time, new records continued to appear, indicating that the malware was still actively collecting and uploading fresh data.

The hosting company declined to reveal who managed the database or whether the data was intended for research or criminal use.

How Can Users Protect Themselves

Cybersecurity experts warn that changing passwords alone may not be enough, especially if malware is still present on a device. Users are advised to take the following steps:

• Install a trusted antivirus or anti-malware software and run a full system scan

• Keep computer and mobile operating systems updated with the latest security patches

• Review app permissions, especially keyboard access, accessibility services, and device admin rights

• Use a reliable password manager to generate and store strong, encrypted passwords

• Enable Two-Factor Authentication (2FA) or biometric security on all important accounts

• Avoid using the same password across multiple websites or apps

Final Takeaway

This incident serves as a stark reminder that cybersecurity threats are evolving rapidly. Even without a direct hack, millions of users can be put at risk through malware and careless data storage. Staying alert, updating devices regularly, and following strong digital hygiene practices are no longer optional—they are essential.