Gmail passwords in data leak along with Yahoo, Outlook, Facebook, Instagram, TikTok and Netflix, says cyber security expert
Gmail passwords have been uncovered in a data leak along with other mailbox providers Yahoo and Outlook and social media sites including Facebook, Instagram and TikTok, a cyber security expert has revealed.
A cyber security researcher claims to have found evidence of a data leak which has exposed the login details of around 149 million accounts - including for the likes of Gmail, Roblox, Instagram, Facebook, dating sites and more.
Jeremiah Fowler says he has uncovered how the login and password details have been leaked and has shared his findings with tech website ExpressVPN in a bid to alert the public to the breach. He told the site the publicly exposed database was not password-protected or encrypted, and contained 149,404,754 unique logins and passwords.
"In a limited sampling of the exposed documents, I saw thousands of files that included emails, usernames, passwords, and the URL links to the login or authorization for the accounts," he said.
"This is not the first dataset of this kind I have discovered and it only highlights the global threat posed by credential-stealing malware. When data is collected, stolen, or harvested it must be stored somewhere and a cloud-based repository is usually the best solution.
"This discovery also shows that even cybercriminals are not immune to data breaches. The database was publicly accessible, allowing anyone who discovered it to potentially access the credentials of millions of individuals."
Exposed records included usernames and passwords collected from victims around the world, he said, including from apps such as social media platforms Facebook, Instagram, Tiktok and X (formerly Twitter), dating sites, OnlyFans accounts, Netflix, HBOmax, DisneyPlus, Roblox, and more.
Financial services accounts, including crypto wallets or trading accounts, banking and credit card logins and others also appeared, he went on. "One serious concern was the presence of credentials associated with .gov domains from numerous countries," he said.
"While not every government-linked account grants access to sensitive systems, even limited access could have serious implications depending on the role and permissions of the compromised user.
"Exposed government credentials could be potentially used for targeted spear-phishing, impersonation, or as an entry point into government networks. This increases the potential of .gov credentials posing national security and public safety risks."
The researcher said he had reported the vulnerability to the hosting provider via their online report abuse form. "I received a reply several days later stating that they do not host the IP and it is a subsidiary that operates independently while still using the parent organization's name," he added.
"It took nearly a month and multiple attempts before action was finally taken and the hosting was suspended and millions of stolen login credentials were no longer accessible."
Jeremiah's research showed accounts from the following email providers were exposed:
- 48M - Gmail
- 4M - Yahoo
- 1.5M - Outlook
- 900k - iCloud
- 1.4M - .edu
And social media platforms exposed included:
However, he said he did not claim any "wrongdoing by the hosting provider or IP owner, nor against any of their staff, representatives, partners, affiliates, or associated entities", or that the data was in "immediate danger".
"The publication of these findings is intended only to promote awareness around data protection and privacy risks, with the goal of encouraging organizations to adopt proactive safeguards to prevent unauthorized access to sensitive information," he said.