A Staggering 149 Million Account Credentials Just Leaked Online

According to HotHardware, cybersecurity researcher Jeremiah Fowler discovered a massive, publicly accessible database containing a staggering 149 million stolen user credentials. The compiled data, sourced from past breaches, impacted users of major platforms including Gmail, Yahoo, Outlook, iCloud, Facebook, Instagram, TikTok, Binance, Roblox, Netflix, and OnlyFans. Specifically, 50 million of the exposed records were linked to email providers, with 48 million being Gmail accounts alone. The database also included credentials for financial services, crypto wallets, and even some .gov domains. Fowler reported the exposure, and the main database has since been taken down, but it’s unknown how long it was publicly accessible or if copies were made.

The Old Data Problem

Here’s the thing that’s both reassuring and terrifying: this wasn’t a new hack. Basically, this was a “mega-compilation” of data from older breaches, some of which had been held privately by cybercriminal groups. So if you’ve been diligent about changing passwords after major breaches over the last few years, you’re *probably* in better shape. But that’s a big “if.” And it reveals a darker trend: the cybercrime underground has its own supply chain. The report even notes that some hackers were themselves hacked to source this data. It’s a reminder that once your data is out there, it never really goes away—it just gets repackaged and resold.

Why This Keeps Happening

So why does this feel like it’s happening more often? Look, it’s not just better reporting. There’s a grim economic logic at play. The original report hints at it: when times get tough and prices rise, crime tends to increase. Cybercrime is no exception. It’s a low-risk, high-reward gig for many. And with so much of our lives—from work to social media to banking—living online, the attack surface is enormous. We’re not just talking about email passwords anymore. This leak had crypto wallets and trading accounts. The potential payoff for criminals is huge, and the consequences for getting caught are still relatively slim.

What You Actually Need To Do

Now, the standard advice applies, but let’s be real about it. Yes, you should reset passwords, especially on critical accounts like email (which is the key to resetting *everything else*). Yes, you absolutely need to enable two-factor authentication (2FA) wherever possible—SMS is okay, but an authenticator app is better. And seriously, consider a password manager. It’s 2024; memorizing dozens of unique passwords is a fool’s errand.

But beyond that, this leak underscores the need for systemic vigilance. Be skeptical of that browser extension or that “must-have” free software. Check your account login histories. This stuff is pervasive. As Fowler’s report on the ExpressVPN blog states, the number of records in the database was actually *increasing* while it was exposed. The database is down, but the data is out there. It’s not a question of *if* your old credentials are floating around, but *where*. Act accordingly.