Archive · 25 Jan 2026
149 Million Credentials Leaked in Unprotected Database
A big problem happened where 149 million usernames and passwords were found online without any protection.
This wasn't done by hackers but by a researcher who found the data was left open for anyone to see.
The passwords were from many big websites like Gmail, Instagram, Netflix, and even some government sites.
The data was collected by a sneaky computer program called malware.
The researcher told the people who were hosting the data, but it took a month for them to take it down.
During that time, more passwords were added.
To stay safe, people should check their devices for malware, use special programs to manage passwords, turn on extra security steps like two-factor authentication, and not use the same password for different sites.
149 million unique login credentials were exposed in an unprotected cloud database.
Affected services include Gmail, Instagram, Netflix, OnlyFans, and government domains.
The data was collected by infostealer malware and stored without encryption.
The database was accessible for a month before being suspended.
Experts recommend scanning for malware, using password managers, enabling two-factor authentication, and avoiding password reuse to stay safe.
- Who
- Cybersecurity researcher Jeremiah Fowler
- What
- Discovered a massive data leak of 149 million unique login credentials
- When
- The database was accessible for a month before being suspended
- Where
- The data was stored in an unprotected cloud-based repository
- Why
- The data was collected by infostealer malware and stored without proper security measures
- Total Exposed Credentials
- 149,404,754 unique logins and passwords
- Data Size
- 96 GB of raw credential data
- Email Accounts Affected
- 48 million Gmail, 4 million Yahoo, 1.5 million Outlook
- Social Media Accounts Affected
- 17 million Facebook, 6.5 million Instagram, 780k TikTok, numerous X (Twitter)
- Entertainment Accounts Affected
- 3.4 million Netflix, HBO Max, Disney+, Roblox
- Financial & Government Accounts Affected
- 420k Binance, banking logins, government (.gov) domains
- Malware Type
- Infostealer malware
- Hosting Suspension Time
- 1 month after reporting
Sources
Massive breach exposes 149 million Instagram, Gmail, OnlyFans passwords: How to stay safe?
149 Million Passwords Left Exposed in Massive Credential Leak: What Users Must Do Now
Login credentials of 149 mn accounts including Gmail, Facebook, Netflix leaked: Report
Instagram, Gmail, Netflix, OnlyFans data breach: 149 million logins, passwords leaked, here’s what to do
Login credentials of 149 million accounts including Gmail, Facebook, Netflix leaked: Report
Login credentials of 149 mn accounts including Gmail, Facebook, Netflix leaked: Report - Telegraph India
Gmail, Facebook, Netflix passwords of 149 million users leaked
149 Million Passwords For Gmail, Facebook, And Netflix Leaked: Report
Data Dystopia: 149 Million Gmail, Facebook, Instagram Passwords Exposed In Massive Cyber Breach
