A database containing usernames and passwords for 149 million accounts, including 48 million Gmail, 17 million Facebook, and 420,000 Binance accounts, was taken down after security analyst Jeremiah Fowler reported it to the hosting providers. Fowler was unable to identify the database’s owner, leading him to notify the host, which removed it for violating terms of service. The database also included credentials from government systems, banks, and streaming platforms, suggesting it was compiled by malware using techniques like keylogging.
Fowler observed that the database continued to grow over a month, indicating active data collection. It was hosted by an affiliate in Canada of a global provider. He described it as a “criminal’s dream wish list” due to the variety of credentials available, which could be organized for cybercriminals seeking specific subsets of information. The database also contained credentials from Yahoo, Microsoft Outlook, Apple iCloud, TikTok, OnlyFans, and Netflix.
Fowler did not specify the database’s owner but noted its potential utility in cybercrime. According to Allan Liska, threats from information-stealing malware create a low entry barrier for new criminals who can easily access and automate the collection of sensitive data, highlighting concerns about the growing risk of breaches.
Source link
