Exposed Vibetech Database Held 13.7 Million Records Pulled From Earlier Breaches

Fowler, who hunts for databases that are neither encrypted nor password-protected, said the archive was sorted by company name and that a limited sample showed accounts and credentials belonging to people in several countries. Almost eight million of the records came from an AT&T leak. The rest included 1.2 million records attributed to Amazon, 420,000 to Walmart, 24,000 to BluBank Digital Bank and 18,000 to PayPal, along with 4,084 records from an FBI employee directory and 929 from Interpol.

Because the collection carried passwords and banking details, TechRadar reported, anyone who located it could have used the data to reach victims' online accounts, escalate privileges for ransomware attacks or transfer funds from bank accounts.

Fowler traced the database's IP address to a data intelligence platform operated or developed by Vibetech, and said the company appeared to have gathered datasets from previous breaches or leaks and then left them publicly accessible without authentication. After he notified the company and its hosting provider, the database was restricted and could no longer be reached publicly. A day later, according to his account, the IP address no longer served plaintext credentials and instead displayed the dashboard of an information security management system compliance platform.

In his report, Fowler said a growing number of organizations intentionally collect and sell breached credential datasets, citing research, monitoring or threat intelligence purposes. "Although these datasets can provide valuable insights into attack trends, credential reuse, and emerging threats, organizations that collect compromised personal information operate in a legally and ethically complex environment," he wrote.

Unprotected databases remain a leading cause of data leaks, and in many cases the exposure is unintentional: companies that generate or harvest data misconfigure storage buckets or assume the cloud provider is responsible for securing it. In early 2024, Cybernews found an archive containing personal information on about 223 million Brazilians, discovered through a query in Elasticsearch, though researchers could not identify its owners. In 2021, researchers found an unsecured database on Amazon's AWS cloud owned by the US marketing company OneMoreLead, exposing personally identifiable information of up to 126 million US citizens, including email addresses, home addresses and phone numbers.

TechRadar advised anyone who believes their information may have been exposed in these breaches to change passwords immediately and to treat incoming email messages with caution.

Editor's Summary

A researcher found an unprotected database with 13.7 million records assembled from past breaches, including credentials and banking data attributed to AT&T, Amazon, Walmart, PayPal, banking and law enforcement sources. The IP address was linked to Vibetech, which appeared to have collected breach datasets and left them publicly reachable; the archive was secured after Fowler notified the company and its host. The case adds to a pattern of unintentionally exposed databases, and affected individuals are urged to change passwords.