- A whopping 149 million certificates are exposed online
- Includes usernames and passwords for bank, social media, and .gov accounts.
- It is not known how long the base was open, but it has now been removed.
Cybersecurity researcher Jeremiah Fowler (bIowa ExpressVPN) reexamined a large publicly available data set.
A vast repository of unique usernames and passwords is left open on the Internet without password protection or encryption.
The data contained more than 149 million username and password combinations, amounting to nearly 98GB of credentials, covering nearly every type of online account.
149,000,000 certificates have been issued
Credentials found inside the container cover financial services, including cryptocurrency wallets, merchant accounts and bank account details. Credentials from social media and dating apps were also included in the database.
In addition to the personal accounts, several email accounts with .gov domains were found in the container.
Little is known about the source of the exposed cloud storage container, but Fowler noted that traces of InfoStellar and keylogger malware are present in the database. After the discovery, Fowler tried to find the account owners, but was unable to find relevant information.
Instead, Fowler tried to contact the hosting provider, which told him the container was hosted by an independent subsidiary. It took about a month to dismantle the container, notes Fowler.
Interestingly, the credentials stored in the database were indexed to be easily searchable using “host_reversed paths”, meaning the database could have been the work of an organized hacker or a research database.
A database of this size and scope can be used for very nefarious purposes such as phishing, bank and credit fraud, and even identity theft. It is currently unknown how long the database has been open.
The best password manager is one of the best ways to prevent your credentials from being stolen. Many password managers store your username and password in encrypted storage using two-factor authentication and scan the dark web to see if any of your credentials have been exposed.
The best identity theft protection for any budget
