Cybernews researchers discovered an exposed database containing 24 billion records, including usernames, email addresses, plaintext passwords, and login URLs. The data appears to come from infostealer malware logs, records stolen from infected devices and collected from Telegram channels, breach compilations, and other sources.

While data leaks spilling millions of records have become the norm, one involving 24 billion records, including usernames and passwords, is something else. That’s why the Cybernews research team had to triple-check their findings after uncovering over 8 terabytes of data exposed online.

Our team discovered what is likely to be one of the largest databases ever exposed on June 12th. The vast majority of the 24 billion exposed records, our researchers believe, were infostealer logs. In other words, stolen usernames, passwords, and services that these credentials were supposed to grant access to.

“The credential data leak is dangerous simply because of its enormous size. Since the data leaked online, billions of affected accounts are at serious risk of takeovers, especially if they are not protected with multi-factor authentication,” the team explained.

What did the 24 billion record data leak reveal?

The records our team uncovered were stored on a publicly available Elasticsearch cluster, a group of interconnected search servers. The total volume of information in the cluster exceeded 8.3 terabytes.

Nearly all exposed records were infostealer logs, data collected by malicious software that steals sensitive information. According to the team, the logs revealed login credentials in raw format, with each login detail saved separately, including email addresses, usernames, and passwords in plaintext.

Additionally, researchers identified URLs that the leaked credentials are supposed to grant access to, as well as the source of the logs.

The exposed credentials came from 36 distinct sources, varying from Telegram channels to combined data collections of previous data breaches and datasets exported directly from live target servers.

Which Telegram channels are involved in the data leak?

For example, over 1.7 billion records supposedly came from various Telegram channels. All channels appear to be involved in cybercrime, with a focus on stolen credentials and data breaches.

Most of the 36 data sources, over 30, are Telegram channels with a number of records ranging from hundreds of millions of exposed records to a few thousand. While most of the channels were in English, some were in Russian.

To avoid advertising Telegram channels that contain stolen credentials, we will not mention their names. However, most of the Telegram-based records were supposedly taken from hacking-related channels.

Another category of Telegram channels includes access to stolen credit card data, with one channel apparently dedicated to sharing this information.

Interestingly, nearly 260 million records came from Telegram channels with “Darkside” in the title. Several years ago, Darkside was among the most prolific ransomware groups. The gang infamously attacked the Colonial Pipeline, causing fuel supply disruption on the US East Coast.

Billions of records in unknown “collections”

A staggering 22.6 billion records supposedly came from what the data owner named “collections.” These records could come from various infostealer collections previously leaked online, or they may indicate that the records are grouped by the services they are supposed to provide unauthorized access to.

Since the data was taken out of public view soon after the discovery, our researchers could not further investigate the origin of the information within the so-called “collection” source.

The same reason prevented the team from deducing exactly which service providers were exposed. However, given the colossal number of records involved, it’s highly likely that they reveal access to services with very large user bases.

The team also noticed a source with 150 million records named “local database dumps.” Records from this source likely indicate they were exported directly from live target servers. Local database dumps typically involve downloading the contents of a certain database on a user device.

In this particular case, “local data dumps” could mean the person running the server uploaded records to the collection themselves, or that they got the data from other sources.

“Additionally, records contained file names from where they were imported. In total, there were at least 195 distinct file names. Some of them indicated that the credentials in question came from the AntiPublic collection and what kind of accounts they include,” our researchers said.

AntiPublic collection is a stealer log combo list that first appeared in 2016 and contained around 600 million records. The AntiPublic-related information in the leak categorized credentials in the AntiPublic collection. For example, some files contained logins to only adult content services or only to streaming platforms.

Another 146 million records came from a source named “breach compilation combo” and most likely contain information from past data breaches that exposed user credentials. Attackers favor exploiting information from past breaches, since users often reuse credentials and rarely change passwords.

The source with the smallest number of records was named “Redline stealer” and only contained 27 records. RedLine stealer is a common infostealer that operates as a malware-as-a-service (MaaS), allowing low-skilled attackers to participate in cybercrime.

Owner interested in news articles and social media posts

Interestingly, our researchers found a small subset of data, around 17,000 records, containing information that's rarely seen in data leaks. For example, over 9,500 documents contained CVE (Common Vulnerabilities and Exposures) IDs and descriptions, along with corresponding GitHub repository URLs.

One of the vulnerabilities identified in the exposed cluster involved a Valhall GPU Kernel Driver issue.

Moreover, over 5,200 documents contained logs of news articles related to recently occurred data breaches with article URLs, their contents, and short descriptions. One of the news articles was published as recently as February 2026 and covered a supply chain attack targeting the Python Package Index (PyPI) repository.

Another 2,900 documents were logs of social media posts related to cybersecurity incidents. One of the posts our team saw discussed operational details of the Babuk ransomware from 2021.

All of this points to the data owner actively monitoring the cybersecurity landscape, with a likely intent to update their vast collection of credentials with records from the latest data breaches and data leaks.

The known unknowns

While we are confident the data leak our team has uncovered indeed contains a whopping 24 billion records, there are limitations to what we know about the data inside the now-closed Elasticsearch cluster.

For one, the team had limited time to investigate the data leak, which prevented us from delving deeper into the types of information that may have been included in the “Collections” source.

Moreover, we cannot confidently estimate how many duplicates were included in the leak, leaving the potential number of exposed individuals a guessing game. However, it would hardly be a surprise that a data leak involving 24 billion records would affect more than a few online accounts.

At this point, we’re also unable to accurately say how old or new the leaked data is. Based on the February, 2026 news article contained in the data leak, it appears the data’s owner regularly updates the cluster with new information.

We also do not know who the data owner is, or why anyone would hoard so much data. Our team believes that “both a company and an individual threat actor could be collecting such information for various purposes.”

“Companies could collect this data for a monitoring service or a security check service, and threat actors could be collecting this data to aid in discovering fresh exploits to help them with data breaches,” our researchers said.

Meanwhile, our team believes that when it comes to historic data leaks, hoarding everything is the way to go.

“Why wouldn't they hoard so much data? When it comes to historical leaked data and information on exploits and attacks, the more information you have, the better, as it allows for better insights, and helps detect more relevant compromised accounts, and ways that a given target could be breached,” the team explained.

Leaking billions of records is becoming the norm

Unfortunately, datasets with billions of records are more often left publicly accessible. Earlier this year, our team discovered another exposed Elasticsearch cluster that contained over 160 indices, holding 8.7 billion of primarily Chinese records, ranging from national citizen ID numbers to various business records.

Meanwhile, last December, our team found a database with 4.3 billion records, some of which included LinkedIn-derived personal information. The 16TB-strong instance contained emails, photos, employment histories, and other personal data. A single collection alone contained 732 million records, including photographs.

In July 2025, Cybernews researchers uncovered one of the largest data leaks in history after discovering several collections of login credentials, containing a total of 16 billion records. The team found 30 exposed datasets, each containing tens of millions to more than 3.5 billion records.

However, the only data leak comparable to the recent discovery is the one our team found back in 2024. The supermassive leak contained data from numerous previous breaches, comprising an astounding 12 terabytes of information spanning over 26 billion records.

Disclosure timeline:

• Leak discovered: June 12th, 2026
• Leak observed closed: June 15th, 2026

---

Unlock more exclusive Cybernews content on YouTube.