Previously leaked credentials can become a fresh security risk when they are collected in an unsecured database.
In an Oct. 12 report published by ExpressVPN, cybersecurity researcher Jeremiah Fowler described finding 13.7 million publicly accessible records in a database linked to India-based AI software development company Vibetech.
The collection included datasets labeled with names such as AT&T, Amazon, Walmart, and PayPal. Those labels do not establish new breaches at the named companies.
The incident highlights a persistent problem with stolen data. Information compromised in one breach can remain a threat long after the original incident, particularly when it is collected into another database with inadequate security. Although the database was reportedly secured after disclosure, it remains unclear whether unauthorized parties accessed or downloaded the records before that happened.
Details of the incident
Fowler linked the database’s IP address to a data intelligence platform he said was operated or developed by Vibetech. The record count does not establish how many distinct people were affected.
Fowler noted that, in a limited sample, the data belonged to people from several countries, highlighting how large-scale data collection can expose people scattered globally in one high-risk location.
The identified data includes names, phone numbers, email addresses, passwords, bank account details, and others.
Fowler listed collections labeled AT&T Data Leak, Gambling Private Combo, casio.ru Data Breach, and Amazon Private Combo, containing approximately 7.91 million, 2.24 million, 1.71 million, and 1.21 million records, respectively.
Other labels referenced Walmart, WhatsApp users in Spain, PayPal, an FBI employee directory, and Interpol. The labels alone do not verify the records’ origins.
Fowler noted that some datasets did not match known public breach counts, leaving their precise origins uncertain.
After identifying the exposure, Fowler notified the company associated with the IP address and its hosting provider. The database was subsequently restricted. By the following day, the IP address was displaying an Information Security Management System (ISMS) compliance platform dashboard.
The exact relationship between Vibetech, the platform, and the database remained unclear.
Fowler suggested that the platform could have been an internal project or software developed for a third-party client. It remains unknown how long the database was exposed or whether anyone else accessed it.
A different form of data risk
For security teams, the incident highlights two responsibilities: responding to exposed credentials and protecting any breach data their organization collects.
When exposed credentials are linked to work accounts, teams should investigate whether those accounts remain active, reset affected passwords, and review sign-in activity for suspicious access. An old password may no longer work, but accompanying names, email addresses, and phone numbers can still help attackers craft convincing phishing messages.
Organizations maintaining breach intelligence repositories should require authentication, restrict access to authorized personnel, and monitor bulk queries and downloads. Raw credentials should be retained only where necessary for a defined defensive purpose.
If a repository becomes publicly accessible, responders should preserve available logs and investigate the exposure window alongside restricting access. Closing the database addresses ongoing exposure; it does not establish whether copies were already taken.
Bringing those records together creates another point of exposure, potentially making it easier to search, organize, and retrieve credentials from different sources without locating each original leak. Have I Been Pwned illustrates a more restricted approach: its email search does not reveal associated passwords, and domain searches require verification of control. Breach monitoring can provide useful information without making raw credentials publicly available.
The risk does not end when the database is secured. Anyone who accessed and downloaded its contents before access was restricted could retain a copy, beyond the owner's immediate control. The reports do not establish whether this happened, but the possibility illustrates why removing public access cannot guarantee that exposed information has been recovered or erased.
What this means for you
Your password does not become safe simply because the breach that exposed it happened years ago. If you still use the same password on other services, criminals could try it against your email, banking, or social media accounts, potentially gaining access without having to break into those platforms directly.
Using a unique password for every account and enabling multifactor authentication can reduce that risk.
If you suspect your credentials have been exposed, change the affected passwords and any reused versions, starting with your email and financial accounts. You can search your email address on Have I Been Pwned for appearances in breaches it has indexed. A clear result does not prove your information has never been exposed, and the search cannot necessarily confirm inclusion in this particular database.
But the responsibility does not rest with users alone. Companies that collect, analyze, or store previously leaked information must protect it too, because securing the original service means little if the same data can be exposed again somewhere else.
Read more: The Denmark registry breach highlights the risks of weak authentication and third-party access, reinforcing why sensitive databases need strict access controls and monitoring.