The discovery of an unsecured database holding 13.7 million records from previous cyberattacks has exposed a troubling practice in the cyber threat intelligence industry: the mass collection of stolen credentials. Security researcher Jeremiah Fowler found the unprotected archive sitting on the open internet, linked to Indian software development platform Vibetech. The database contained passwords, banking details and personal information from past breaches at major firms including AT&T, Amazon and PayPal.

What You Need to Know

Vibetech, an Indian software development platform, collected data exposed in various leaks and cyberattacks into a single repository. The archive was left unprotected online, making it accessible to anyone who knew where to look. The database was secured after Fowler notified the company and its hosting provider. This incident highlights the legal and ethical complexities of aggregating breached data for threat intelligence purposes.

Inside the Exposed Archive

Fowler's research revealed that the database was organized by company names. The majority of records, nearly eight million, originated from an AT&T data leak. Other significant contributions came from Amazon with 1.2 million records, Walmart with 420,000, BluBank Digital Bank with 24,000 and PayPal with 18,000. Even smaller leaks from the FBI Employee Directory and Interpol were included. The presence of passwords and banking details makes this archive particularly dangerous, as threat actors could directly access accounts, escalate privileges for ransomware attacks or wire funds from bank accounts.

  • AT&T: Nearly 8 million records from a previous data leak.
  • Amazon: 1.2 million records exposed.
  • Walmart: 420,000 records included.
  • PayPal: 18,000 records compromised.

The Rise of Breach Data Aggregation

According to Fowler's report, a growing number of organizations intentionally collect and sell breached credential datasets, ostensibly for research, monitoring or threat intelligence. However, the legality of this activity remains questionable. "Although these datasets can provide valuable insights into attack trends, credential reuse and emerging threats, organizations that collect compromised personal information operate in a legally and ethically complex environment," Fowler argues. This incident underscores the risks when such repositories are not properly secured.

Why This Matters

The Vibetech exposure is more than a one-off security lapse. It signals a systemic problem in how threat intelligence firms handle compromised data. As more companies aggregate breach data, the potential for accidental leaks grows. Affected individuals face heightened risks of identity theft, financial fraud and targeted phishing. For businesses, the incident raises questions about third-party data handling and regulatory compliance. The fallout could prompt stricter oversight of data collection practices and force platforms to adopt more robust security measures. Ultimately, the line between legitimate threat research and privacy violation is blurring, and this case may become a reference point for future legislation.

What You Need to Know

If you suspect your information was exposed in any of these breaches, change your passwords immediately and enable two-factor authentication where possible. Be cautious of unsolicited emails or messages asking for personal details. Monitor your bank and credit card statements for unauthorized activity. Consider using a password manager to generate and store unique credentials for each account. Stay informed about data breaches that may affect you by checking reputable sources like Have I Been Pwned.