A Repository of Stolen Data Exposed Online

An Indian software development company, Vibetech, has inadvertently exposed a massive database containing 13.7 million records from various historical data breaches. Security researcher Jeremiah Fowler discovered that the archive was left accessible on the public internet without any authentication, posing a significant risk to millions of individuals.


The Scope and Severity of the Leak

The compromised database acted as a centralized collection point for information harvested from past cyberattacks. Among the records, researchers identified highly sensitive personal data, including email addresses, phone numbers, passwords, and banking information. The archive was organized by the source of the breach, with the majority of entries originating from major corporations:

  • AT&T: Nearly 8 million records
  • Amazon: 1.2 million records
  • Walmart: 420,000 records
  • BluBank Digital Bank: 24,000 records
  • PayPal: 18,000 records

Additionally, the repository contained smaller datasets, such as 4,084 records from the FBI Employee Directory and 929 records linked to Interpol.


Unlike standard data breaches, the presence of plaintext passwords and banking details makes this exposure exceptionally dangerous. As noted by industry experts, such data can be directly leveraged by threat actors to hijack user accounts, launch ransomware attacks, or commit financial fraud.


Ethical and Legal Implications

The discovery has sparked a debate regarding the practices of firms that aggregate stolen data. While such companies often claim these collections are for threat intelligence or research, their activities occupy a murky legal and ethical space. According to Fowler,

“Although these datasets can provide valuable insights into attack trends, credential reuse, and emerging threats, organizations that collect compromised personal information operate in a legally and ethically complex environment.”


Database Secured Following Disclosure

Upon notification by the researcher, both Vibetech and the hosting provider took action to restrict access to the database. Shortly after the disclosure, the IP address was updated to display an Information Security Management System (ISMS) compliance dashboard instead of the exposed credentials.


This incident underscores the persistent danger of misconfigured, unprotected databases, which remain a primary driver of global data leaks. Security professionals strongly advise individuals who may be affected by these or similar breaches to update their passwords immediately and remain vigilant against suspicious incoming communications.