A publicly accessible database containing 13.7 million records of previously breached credentials was discovered on infrastructure linked to Vibetech, an India-based AI software development and IT services company. The database contained sensitive information, including email addresses, phone numbers, passwords, names, and bank account details.
Cybersecurity researcher Jeremiah Fowler discovered the database without password protection or encryption. According to his report on ExpressVPN’s website, the collection included records associated with multiple previous data breaches and credential leaks. The information could be viewed and queried through a web browser without authentication.
Fowler notified the company connected to the IP address and its hosting provider. Following the disclosure, access to the database was restricted. The next day, the IP address displayed an Information Security Management System (ISMS) compliance dashboard instead of the exposed credentials.
It is unclear how long the database remained accessible, whether anyone else accessed it, or how the information was collected. The report does not establish that Vibetech was responsible for the original breaches or that the company itself suffered a new data breach.
The repository appeared to combine data from several previously reported breaches and leaked credential collections. According to Fowler, some of the datasets referenced major companies and services, while others contained information associated with financial institutions, government agencies, and educational databases.
Some of the largest collections included:
- AT&T data leak: 7.9 million records
- Gambling Private Combo: 2.2 million records
- casio.ru data breach: 1.7 million records
- Amazon Private Combo: 1.2 million records
- Walmart Private Combo: 420,368 records
- Spain WhatsApp database: 98,325 records
- BluBank digital bank leak: 24,021 records
- PayPal Private Combo: 18,157 records
The repository also contained entries referencing an FBI employee directory, an Interpol data leak, and a database containing Belgian personal and banking information.
These figures represent the records attributed to individual datasets, not necessarily unique individuals. The report does not establish how much overlap existed between the collections.
Fowler also found that some datasets did not match the record counts associated with known public disclosures. While this could indicate that the repository combined different sources, the available evidence does not confirm whether it contained previously undisclosed breaches.
I think the biggest concern here is not whether the data was stolen recently. It is how easily someone could access millions of records in one place without needing any special access.
Old credentials can remain useful to attackers for years, especially when people reuse passwords across multiple websites. A password exposed in an earlier breach might still work on another service if the user has not changed it.
Attackers can use these records for credential stuffing, which involves automatically testing stolen username and password combinations against other services. Email addresses and phone numbers can also help them create targeted phishing campaigns or impersonate legitimate businesses.
The risks increase when information from multiple breaches is combined. An email address, phone number, and previously exposed account details can help an attacker build a more complete profile of a person. This information may then be used in identity theft, financial fraud, or business email compromise attacks.
However, there is an important point to note between exposure and exploitation. Fowler’s report does not claim that criminals accessed the database or used the records in an attack. The concern is that the lack of access controls made the information available to anyone who discovered the exposed service.
Companies collect leaked credentials for legitimate security purposes, including threat intelligence and monitoring compromised accounts. Such information can help organizations identify exposed passwords and detect potential attacks.
But collecting breached data creates another security risk. Information that was already exposed in one incident can be exposed again if the organization storing it fails to protect its database.
In this case, the reported lack of authentication meant that anyone who reached the database could access its contents. I believe this is the more important lesson from the incident. Even if an organization collects compromised credentials for security research, it must treat them as highly sensitive information rather than ordinary datasets.
Encryption, access controls, monitoring, and regular security audits are very important when handling such information. Encryption alone would not have prevented this exposure if an application could still display the decrypted records to unauthenticated visitors, but it could have provided another layer of protection.
There are also privacy and regulatory considerations when organizations store personal information collected from previous breaches. The legal obligations depend on the data involved, the organizations handling it, and the applicable jurisdictions.
Fowler did not allege wrongdoing by Vibetech or its contractors. The report also does not establish how the company obtained the credentials or whether the database belonged to an internal project or a service developed for a third-party client.
Users can check whether their email addresses have appeared in known data breaches using Have I Been Pwned. If an account has been exposed, they should change its password immediately and update the password on any other accounts where they reused it. Using a unique password for every service, storing passwords in a password manager, and enabling multi-factor authentication (MFA) can further reduce the risk of account compromise. Even if an email address appears in a breach, it does not necessarily mean the account is still compromised, but it is worth reviewing its security.
Organizations should review their own exposure and ensure that databases containing credentials cannot be accessed publicly without proper authentication and authorization. Regular security assessments can help identify misconfigured services before they expose sensitive information.
This incident shows that data breaches do not always end when the original incident is resolved. Previously compromised information can create new risks when it is collected, stored, and exposed again. I believe organizations handling breach intelligence must be held to the same basic security standards they expect from the companies they help protect.
