Unprotected database exposed 149 million stolen login records
An exposed database held 149 million login records collected by password-stealing malware, including email, social and financial accounts. It was taken offline. Check devices for malware, replace exposed or reused passwords and enable two-factor authentication.
If you suspect a device is infected, update it and run a malware scan or ask trusted IT support to check it. From a clean device, replace exposed or reused passwords with unique ones, starting with email and financial accounts. Enable two-factor authentication or passkeys where available, and review recent account activity.
What’s happening
Researcher Jeremiah Fowler reported 149,404,754 login records in a database accessible without a password or encryption. Records included email addresses, usernames, passwords and associated login URLs for email, social media, streaming, dating and financial services worldwide. The total counts records, not confirmed individual victims. Google told Tom’s Guide that the material was an accumulated collection of credentials stolen from personal devices by malware; this was not evidence of a new intrusion into Google or Meta. Fowler reported 96 GB of data, while TechRadar described 98 GB. The database continued growing during his reporting attempts, before its hosting was suspended. Its operator, exposure duration and whether anyone else accessed or misused this particular collection remain unknown. As of 3 November, no later resolution was identified in the reporting reviewed. Taking the database offline did not establish that stolen passwords were invalidated or infected devices cleaned; there is no incident-specific software patch.
- What
- Breach
- Affects
- Email, social-media, streaming, dating and financial accounts whose credentials were collected by malware
- Fixed in
- Nothing to patch
- Since
- 23 Jan 2026
- Closed
- 26 Jan 2026
Timeline
- Update
Tom’s Guide published Google’s statement that the collection contained credentials harvested from personal devices by malware over time. Google described existing protections that lock accounts and require password resets when exposed credentials are identified, without confirming a reset of every account in this collection.
- Made publicNothing to patch
Jeremiah Fowler disclosed an unprotected database containing 149,404,754 login records. By publication, hosting had been suspended after nearly a month of reporting attempts; the discovery and suspension dates were not disclosed.
Sources
- 149M Logins and Passwords Exposed Online Including Financial Accounts, Instagram, Facebook, Roblox, Dating Sites, and More.ExpressVPN / Jeremiah Fowler · 23 Jan 2026
- 149 million logins and passwords exposed for Gmail, Facebook, Instagram and more — everything you need to knowTom’s Guide · 26 Jan 2026
- Huge data leak of 149 million credentials exposed without any protectionTechRadar · 23 Jan 2026