WIRED (Security)

149 Million Usernames and Passwords Exposed by Unsecured Database

A publicly accessible database containing 149 million usernames and passwords—including 48 million Gmail, 17 million Facebook, and Binance credentials—was removed after security researcher Jeremiah Fowler reported it to the hosting provider. The collection also featured government, banking, and streaming service logins, suggesting it was assembled by infostealing malware that captures keystrokes. Fowler observed the trove grew over a month and was automatically indexed for rapid searching, indicating potential resale to cyber‑criminals. Analysts warn that such misconfigured databases and cheap malware rentals dramatically lower the barrier for large‑scale credential theft.