A publicly accessible database containing millions of records linked to previously reported data breaches was discovered on an internet-connected server associated with Vibetech, an India-based AI software development and IT services company.
The database reportedly contained email addresses, usernames, passwords and other information linked to customers, employees and organizations around the world.
According to a security researcher who discovered the exposure, the database was connected to a data intelligence platform that aggregated credential datasets from earlier breaches and leaks. The information was accessible without authentication, allowing anyone with access to the relevant address to view and query the records through a web browser.
The researcher said the exposed collection included references to numerous datasets associated with major companies, financial services, educational institutions and government organizations. Some entries were linked to previously reported security incidents, while others did not match known public disclosure totals, raising the possibility that the collection contained combined datasets or information from previously undisclosed incidents.
After discovering the exposure, the researcher sent a responsible disclosure notice to the company associated with the IP address and notified the hosting provider. The database was subsequently restricted and was no longer publicly accessible. On the following day, the same IP address displayed an Information Security Management System (ISMS) compliance dashboard instead of the exposed credentials.
It remains unclear how long the database was publicly accessible, whether anyone else accessed the information, or how the credentials were originally obtained. Determining whether unauthorized parties accessed the records would require an internal security investigation and an examination of available access logs.
The exposed repository reportedly referenced several large collections of breached information. These included an AT&T data leak containing approximately 7.9 million records, a gambling-related credential collection with 2.2 million records, and a dataset associated with casio.ru containing around 1.7 million records. Other entries included Amazon and Walmart credential collections, a WhatsApp database associated with Spain, a digital banking dataset, PayPal credentials, an FBI employee directory and a collection labeled as an Interpol data leak.
The researcher also emphasized that multiple companies operate under the Vibetech name. The IP address and platform involved in this incident were associated with an Indian .in domain and were not identified as being affiliated with other businesses using the same name. The investigation did not establish how the company obtained the credentials or whether the platform was intended for internal use, research or a third-party client.
The exposure highlights the risks of collecting and centralizing previously leaked information, even when the original breaches occurred years earlier. Data that may once have circulated across underground forums and criminal marketplaces can become much easier to access when millions of records are brought together in a single searchable repository.
Old credentials can remain valuable to cybercriminals, particularly when people reuse passwords across multiple services. Attackers can use previously exposed email addresses and password combinations in credential-stuffing attacks, attempting to gain access to other accounts where the same login details remain valid.
Historical breach data can also help criminals prepare convincing phishing campaigns and targeted social engineering attacks. Information about an individual’s employer, online accounts or previous activities may make fraudulent emails and messages appear more credible. Organizations could face additional risks if exposed employee credentials are used to target business email accounts or internal systems.
Business email compromise remains a significant financial threat. According to the FBI’s Internet Crime Complaint Center, reported losses associated with business email compromise reached approximately $2.77 billion in 2024. Exposed email addresses can help criminals identify potential targets even when the associated passwords have already been changed.
The incident also raises questions about the security responsibilities of organizations that collect and store breached credentials for threat intelligence, monitoring or research. Although such datasets can help security teams identify emerging threats and patterns of password reuse, storing large quantities of compromised personal information creates additional risks if access controls are inadequate.
India’s Digital Personal Data Protection Act and Information Technology Act may be relevant to the handling and protection of personal information, depending on the circumstances and applicable legal requirements. However, the researcher explicitly stated that the findings do not establish wrongdoing by Vibetech India or its contractors, affiliates or related entities. The available information also does not confirm that the exposed credentials were exploited as a result of this incident.
For individuals concerned that their information may have appeared in a previous breach, security experts recommend changing passwords on potentially affected accounts and updating any other accounts that reused the same credentials. Every online service should have a unique password, preferably generated and stored using a reputable password manager. Enabling multi-factor authentication can provide another layer of protection if a password is compromised.
Users should also remain cautious of unexpected emails, text messages and phone calls that request personal or financial information. Criminals may use information obtained from earlier breaches to make fraudulent communications appear legitimate. Verifying requests through official websites or trusted communication channels can help reduce the risk of falling victim to these attacks.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The researcher said they did not download the exposed database and instead relied on a limited number of screenshots for verification and documentation. The findings serve as a reminder that previously compromised information can create new security and privacy risks when it is stored in an unsecured environment and made accessible to the public.
Millions of Exposed Passwords Found in Publicly Accessible Database Linked to Indian AI Company
