A security researcher recently discovered an exposed database containing over 149 million unique login credentials.

This massive collection of stolen data sat on the internet without any password protection or encryption. The 96 GB database included usernames, passwords, email addresses, and exact login URLs for accounts across dozens of services.

Sensitive Information Exposed

The exposed records covered a wide range of popular online services:

• Social media platforms including Facebook, Instagram, TikTok, and X
• Streaming services like Netflix, HBO Max, and Disney Plus
• Banking logins and credit card accounts
• Crypto wallets and trading platforms
• Dating sites and OnlyFans accounts

This included credentials from major email providers with 48 million Gmail accounts, 4 million Yahoo accounts, 1.5 million Outlook accounts, and 1.4 million .edu accounts.

Other notable accounts in the database:

• 17 million Facebook logins
• 6.5 million Instagram logins
• 3.4 million Netflix accounts
• 780,000 TikTok accounts
• 420,000 Binance crypto accounts
• 100,000 OnlyFans accounts

Perhaps most alarming was the presence of .gov domain credentials from multiple countries. Criminals could use these government logins for targeted phishing campaigns or as entry points into sensitive networks.

TROYPOINT Tip: Protect your identity and personal info from a data breach by using Aura Identity Theft Protection which is TROYPOINT’s recommended identity theft protection.

Aura Identity Theft Protection Review

How the Data Was Stolen

The database appeared to store data collected by “infostealer” malware. This type of malicious software quietly harvests credentials from infected devices without the owner knowing.

These programs spread through malicious email attachments, fake software updates, and compromised browser extensions. A recent report found that only 66 percent of U.S. adults use antivirus protection, leaving millions of devices vulnerable.

How You Can Protect Yourself

If you suspect your device might be infected, take these steps now:

• Avoid common passwords for each account and enable two-factor authentication where available. This extra verification step can block criminals even if they have your password. Consider using a password manager to reduce risks from basic keyloggers.
• Check your email address against known breaches and review login activity on your important accounts and look for unfamiliar devices or locations. If you spot suspicious activity, change those passwords from a device you know is clean.
• Update your operating system and install security software immediately. Run a full scan to detect and remove any malicious programs hiding on your device. Simply changing passwords won’t help if malware is still active since it will capture the new credentials too.

Final Thoughts

This discovery shows how credential theft operates as a massive criminal business affecting millions worldwide. Even if you haven’t received a breach notification, your login details could already be circulating in databases like this one.

Taking a few minutes to update passwords and enable two-factor authentication on your most important accounts can prevent criminals from accessing your personal information.

For more details on this story, refer to Jeremiah Fowler’s X profile and his personal website.

We want to know your thoughts. What do you think about this story? Let us know in the comment section below!

Be sure to stay up-to-date with the latest streaming news, reviews, tips, and more by following the TROYPOINT Advisor with updates weekly.