Thought Leadership
An unsecured database linked to an Indian AI company aggregated passwords and banking details from previous leaks, including lists related to Amazon and PayPal.
Security researcher Jeremiah Fowler has discovered an unprotected database containing roughly 13.7 million records from past data breaches and leaks. It contained email addresses, usernames, passwords, phone numbers, and bank account details. The database was linked to an IP address belonging to a data analytics platform run by Indian firm Vibetech, which develops AI software and provides IT services. An open dashboard for threat analysis was also accessible under the same IP address. The report does not clarify what connection the database had to the company’s services.
Collection of Known and Unknown Leaks
The database referenced numerous datasets from earlier incidents. The largest portion consisted of 7.9 million entries from a data breach at AT&T. Added to this were 1.71 million records from a leak at Casio.ru, as well as so-called credential combination lists, including 2.24 million related to gambling websites, 1.21 million to Amazon, 420,368 to Walmart, and 18,157 to PayPal. Such lists aggregate usernames and passwords for specific services, but do not necessarily originate from a direct breach of the respective company. Furthermore, 98,325 entries from a Spanish WhatsApp database, 24,021 from a leak at digital bank BluBank, an FBI employee directory with 4,084 entries, and 929 entries related to Interpol were found. A Belgian dataset contained personal data and IBANs.
According to Fowler, some of the records corresponded to already known incidents. For others, the number of entries did not match publicly available figures. They may potentially stem from previously unknown data leaks.
Access Blocked After Notification
Fowler notified the company and the hosting provider, after which public access to the database was shut down. How long it remained exposed and whether unauthorized third parties accessed it beforehand is unknown.
“One of the most common misconceptions about past data leaks is that older credentials eventually lose their value. In fact, previously exposed information can remain useful to criminals for years after the original incident.”
Jeremiah Fowler, Security Researcher
Aggregated in a single location, the data can be used for credential stuffing, where attackers test stolen username-and-password combinations across other services. Email addresses, phone numbers, and banking information also facilitate targeted phishing attacks. Fowler points out that companies collecting stolen credentials for threat intelligence create a target themselves that must be secured. Those affected should change reused passwords and enable multi-factor authentication.
(Editorial Team)
