Security Researcher Finds 180 Million Exposed User Records from Infostealer Malware

Security researcher Jeremiah Fowler discovered a publicly accessible online database containing over 184 million user records totaling more than 47GB of data. The data included sensitive credentials such as emails, usernames, and passwords linked to major online platforms like Microsoft, Facebook, Apple, and others. The exposed records also encompassed accounts from banks, healthcare providers, and government institutions across at least 29 countries. Fowler believes the data was stolen using infostealer malware, which extracts information from web browsers, emails, and apps. After notifying the database host, World Host Group, public access was restricted. The company revealed the data was uploaded by a fraudulent user. Some victims confirmed the legitimacy of their compromised records, suggesting the vast majority of entries are authentic. Fowler warned that if reused credentials were among the data, users could face mass account breaches. Since it’s unclear how long the database was publicly accessible, users are advised to strengthen security by updating passwords, enabling two-factor authentication, and using a password manager. This incident highlights the ongoing risk posed by credential theft and the importance of proactive digital hygiene.