- Cybersecurity researchers found a database holding 24 billion credentials, usernames, email addresses, and even passwords, floating around online unprotected.
- The leaked data reportedly came from 36 sources, but most of the records appear to be infostealer logs collected from infected devices.
- This database isn’t accessible to the public anymore, but people who already access it can still cause harm with it. Those who reuse passwords face more risk.
Researchers made a stunning discovery on June 12. They found an exposed Elasticsearch cluster holding over 8.3 terabytes of data. The team had to triple-check their findings. A data leak of this size is almost unheard of.
Of these billions of records, a large portion looked like logs collected using infostealer malware. The records contained very sensitive information, usernames and passwords of accounts, including the websites they belong to.
And the worst part? The entire record was stored in plain text so basically anyone could view it. This makes the data extremely dangerous.
A Massive Collection from Many Sources
The exposed credentials came from 36 distinct sources. These ranged from Telegram channels to collections of past data breaches. Some datasets were even exported directly from live servers.
Telegram channels were a major source of the data. Over 1.7 billion records supposedly came from these channels. Most of these records are associated with cybercrimes, particularly sharing stolen credentials and databases from data breaches.
Many of the channels were in English, while some were in Russian. The researchers chose not to name them. They wanted to avoid advertising these criminal spaces. One channel appeared dedicated to sharing stolen credit card data.
About 260 million of these records came from channels titled “Darkside.” For context, Darkside is the ransomware group responsible for the Colonial Pipeline breach that happened some years ago.
The largest source was simply labeled “collections.” This category accounted for a staggering 22.6 billion records. The data owner used this name. The records could be grouped by the services they are meant to access. The researchers could not investigate this source further. The database was taken offline quickly after its discovery.
Another source contained 150 million records named “local database dumps”. These likely came directly from live target servers. The records also included file names showing where they came from.
There were at least 195 distinct file names. Some indicated the credentials came from the AntiPublic collection. AntiPublic is a stealer log combo list from 2016. It contained around 600 million records. Some files in the leak only had logins for adult content services. Others only had logins for streaming platforms.
A source named “breach compilation combo” contained another 146 million records. This likely holds information from past data breaches. Attackers love using old breach data. People often reuse passwords and rarely change them. This makes older credentials still very valuable.
The Unknowns and the Data Owner’s Interests
The researchers found a small subset of data that was unusual. Around 17,000 records contained CVE IDs, descriptions, and GitHub URLs. These are related to known software vulnerabilities.
Over 5,200 documents contained logs of news articles about recent data breaches. One article was from February 2026. Another 2,900 documents were logs of social media posts about cyberattacks.
This suggests the data owner actively follows the cybersecurity world. They likely want to update their collection with the latest breaches.
There are still many unknowns. The team had limited time to investigate the leak. They cannot say how many records are duplicates. It is also impossible to know how many unique individuals it affected.
The age of the data is also unclear. However, the February 2026 article shows the owner recently updated the cluster. But the identity of the data owner remains a mystery. It could be a company or an individual threat actor. A company might collect this data for a monitoring service. A threat actor might use it to find new exploits.
What You Should Do Now
This leak highlights the importance of good online habits. The database may no longer be publicly accessible, but the data is out there. Reusing passwords across multiple accounts is risky, they encourage credential stuffing. If you’re guilty of password reuse, change them now, starting with your important accounts like email, social media, cloud storage, and banking.
This advice is especially relevant for users of Indian platforms. A hacker claims to be selling 224,000 records from Champhunt, a reminder that breaches of local platforms can expose your credentials too.
Additionally, turn on MFA wherever you can. That extra layer makes it harder for hackers to get into accounts. Password managers are your best friend here. They let you create very strong, unique passwords for every account, so you don’t have to sweat about remembering a million text combinations.
Also, they help fend off those sketchy phishing attempts. Stick to downloading apps from legit official sources. And keep all your apps and operating systems updated. These steps can protect your data. They make it much harder for attackers to succeed.
