149 Million Credentials Exposed: The Infrastructure Failure Nobody Saw Coming

A researcher found 149 million login credentials in an unsecured database (96 GB, no encryption). The exposure includes Gmail, Facebook, Instagram, Netflix, government accounts, and crypto wallets. Infostealer malware has surged 6,000% since 2018.

Attackers spend $200 to $300 monthly to generate millions in revenue. Your credentials are likely already compromised. The defense: enable two-factor authentication, reset passwords, scan for malware, and monitor accounts.

Video – Massive Data Leak

What You Need to Know:

• 149 million credentials were exposed in an unprotected database, organized for easy searching
• Infostealer infections increased 6,000% since 2018, operating on $250/month subscription models
• Cost asymmetry favors attackers 20,000 to 1 (organizations spend millions, attackers spend hundreds)
• 7.7 million stolen login logs are for sale right now, feeding continuous credential stuffing attacks
• 54% of infected devices had antivirus or EDR installed, showing traditional defenses fail

What Happened in This Breach

Security researcher Jeremiah Fowler discovered 149 million login credentials sitting in an unsecured database. No password protection. No encryption.

96 GB of usernames and passwords for Gmail, Facebook, Instagram, Netflix, government accounts, and crypto wallets.

The database was indexed for easy searching.

This is not a breach in the traditional sense. This is what happens when credential theft becomes industrial infrastructure. The data came from infostealer and keylogging malware logs, aggregated and organized for exploitation.

Fowler attempted to notify the hosting provider. The database continued to grow during the notification process.

Nearly a month and multiple requests passed before the hosting provider suspended and removed the database for violating terms of service.

Bottom line: The database is down, but the credentials remain valid and weaponized.

Why This Keeps Happening: The Economics

Infostealer infections have surged 6,000% since 2018. The malware operates on subscription models. Criminals pay $250 per month for access to tools that harvest credentials at scale.

The math tells you everything.

At a 1% success rate for credential stuffing attacks, 149 million credentials yield 1.49 million compromised accounts. Dark web pricing puts each compromised account at $10.

That creates a $14.9 million revenue opportunity from infrastructure that costs attackers $200 to $300 monthly to maintain.

Organizations spend millions defending against breaches. Attackers spend hundreds manufacturing them.

The cost asymmetry is 20,000 to 1.

The pattern: When defense costs 20,000 times more than offense, the economics guarantee continuous attacks.

How Bad Is the Credential Supply Chain

An estimated 7.7 million stolen login logs are available for sale right now. Commodity infostealers like RedLine, Lumma, and RisePro feed this economy continuously.

The 2025 data shows an 84% increase in infostealers delivered via phishing compared to 2023. Early 2025 numbers suggest a 180% increase over 2023 levels.

This is not slowing down. This is accelerating.

Credential stuffing accounts for 19% to 25% of all authentication traffic globally. In enterprise environments, that number hits 25%. The highest single-day observation was 44% of all authentication attempts.

Nearly half of all login attempts were attacks.

Reality check: Your credentials are not at risk of being stolen. They are already in the supply chain.

Why Traditional Defenses Fail

66% of U.S. adults use antivirus software. More concerning: 54% of devices infected with infostealers in the first half of 2024 had antivirus or EDR solutions installed.

Traditional defenses are being systematically bypassed.

The architectural flaw is password reuse. 81% of users reuse passwords across two or more sites. 25% use the same passwords across most of their accounts.

One infected device leaks dozens or hundreds of credential sets. The breach multiplies far beyond initial exposure.

The 220 .gov email addresses found in a 10,000-record sample from this database suggest nation-state level exposure potential. Government networks. Academic institutions. Corporate infrastructure.

All accessible through commodity malware and reused passwords.

The weakness: Defense architecture assumes credentials stay contained. Infostealers break that assumption at $250 per month.

What You Need to Do Right Now

The database has been taken down. The credentials exposed in that database are still valid.

Here is what you do:

Enable two-factor authentication on every account that supports it. This breaks the credential stuffing chain even if your password is compromised. Attackers need more than stolen credentials when 2FA is active.

Reset passwords for any accounts using credentials that might have been exposed. Use unique passwords for each service. Password managers make this manageable.

Scan your devices for malware. Update your security software. The fact that 54% of infected devices had protection installed means you are not safe by default. Run manual scans.

Monitor your accounts for suspicious activity. Check login histories. Review account access logs. Set up alerts for unusual login locations or devices.

The global average cost of a data breach hit $4.44 million in 2025. U.S. organizations average $10.22 million.

The infrastructure enabling these breaches costs attackers $200 to $300 per month.

Your move: The cost to protect yourself is time and attention. The cost of doing nothing is total account compromise.

Frequently Asked Questions

How do I know if my credentials were in this database?

The database has been taken down, so direct checking is not possible. Assume exposure if you use Gmail, Facebook, Instagram, Netflix, Yahoo, Outlook, TikTok, OnlyFans, or crypto wallets. Reset passwords and enable 2FA immediately.

Are my credentials safe if I have antivirus installed?

No. 54% of devices infected with infostealers in 2024 had antivirus or EDR installed. Traditional security software is being bypassed. You need 2FA and unique passwords for each account.

What is credential stuffing and why does it work?

Credential stuffing is automated login attempts using stolen username and password pairs. It works because 81% of users reuse passwords. One breach exposes credentials for multiple accounts.

How much do stolen credentials sell for?

Compromised accounts sell for approximately $10 each on dark web markets. Bulk credential databases sell for hundreds to thousands depending on quality and volume.

What is an infostealer and how does it infect devices?

Infostealers are malware that harvest stored credentials from browsers, applications, and files. They spread through phishing emails, malicious downloads, and compromised websites. 84% increase in phishing delivery was observed in 2025.

Is two-factor authentication enough to protect me?

2FA is your strongest defense. It breaks credential stuffing attacks even when passwords are compromised. Enable it on every account that offers it, particularly email, financial, and government accounts.

What should I do if I find suspicious login activity?

Immediately reset your password, enable 2FA if not already active, log out all devices, review connected applications, and check for unauthorized changes to account settings or recovery options.

Why did it take a month to remove this database?

The researcher had to make multiple requests to the hosting provider. Response time depends on provider policies, jurisdictional issues, and verification processes. This delay allowed the database to continue growing during notification.

Key Takeaways

• 149 million credentials were exposed in an unencrypted, publicly accessible database organized for exploitation
• Infostealer malware has increased 6,000% since 2018, operating on $250/month subscription models that generate millions in revenue
• Cost asymmetry favors attackers 20,000 to 1, making credential theft economically sustainable for criminals
• 7.7 million stolen login logs are currently for sale, feeding credential stuffing attacks that account for up to 44% of authentication traffic
• 54% of infected devices had security software installed, proving traditional defenses are inadequate against modern infostealers
• 81% of users reuse passwords, turning single breaches into cascading account compromises across multiple services
• Two-factor authentication is your strongest defense. Enable it everywhere, reset compromised passwords, and scan devices for malware immediately