184 Million Leaked Credentials Found in Open Database

Security researchers have identified a database containing a staggering 184 million account credentials—prompting yet another urgent reminder to update compromised passwords, strengthen weak ones, and enable multi-factor authentication across online accounts. While the database itself does not appear to be newly sourced, it serves as a sobering reflection of the persistent circulation of previously leaked data, involving credentials linked to major platforms such as Apple, Google, Microsoft, Amazon, Facebook, Instagram, and X (formerly Twitter).

In a report recently released by cybersecurity expert Jeremiah Fowler, he emphasized that the emergence of this extensive database on the internet should not instill panic—but rather serve as a compelling call to action. Users should immediately update weak and previously compromised passwords, especially if the same credentials are reused across multiple platforms.

The uncovered database contains 184 million entries, including usernames, email addresses, passwords, and associated login URLs. Alarmingly, the server hosting this trove was left unprotected—without a password or encryption—allowing unrestricted access to anyone who stumbled upon it.

While there is no need for alarm, as the dataset likely comprises aggregated records from prior breaches rather than an entirely new leak, the implications remain serious. At present, there is no evidence to suggest that this database is fundamentally different from others previously circulating on the dark web.

Notably, the dataset has not yet been shared with Have I Been Pwned, a widely used service for checking compromised credentials. Sharing the database with such a platform could help millions of users receive timely alerts through their browsers or password managers, encouraging widespread password hygiene.

In an independent review, Wired analyzed 10,000 samples from the dataset and confirmed that it spans numerous services, including but not limited to Google, Facebook, Instagram, Discord, Microsoft, Netflix, PayPal, Amazon, Apple, X/Twitter, and Spotify.

Crucially, the database does not contain any two-factor or multi-factor authentication (2FA/MFA) details. Thus, users who have enabled these additional security layers on their accounts are safeguarded—even if their passwords were exposed—reinforcing the critical importance of enabling 2FA.

Users are strongly encouraged to review breach notifications within their browsers or password managers. Even robust, reused passwords should be replaced. If you’ve received an alert that a password has been compromised, change it immediately. And most importantly, activate multi-factor authentication on every platform that supports it to fortify your digital security.

Related Posts:

• PyPI’s New Rule: 2FA Verification for All Project Maintainers
• Server-Side Phishing Campaign Evades Detection, Targets Employee Portals
• Sneaky 2FA: A New Adversary-in-the-Middle Phishing-as-a-Service Threat
• Astaroth Phishing Kit Bypasses 2FA, Steals Accounts