AT&T, Amazon, and PayPal credentials found exposed by AI company
Passwords from the old breaches can still get you hacked
By Shutterstock
Follow us
- Researcher Jeremiah Fowler found 13.7 million exposed records linked to Amazon, AT&T, PayPal, and other organizations.
- The database included email addresses, usernames, passwords, phone numbers, and bank account details from past breaches.
- Old leaked passwords can still help attackers break into accounts when people reuse credentials across services.
- Users should change reused passwords, enable multi-factor authentication, and verify suspicious messages through official channels.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
A researcher discovered millions of records containing credentials linked to Amazon, Walmart, AT&T, PayPal, and other companies. The sensitive data was left exposed to anyone on the internet.
Millions of passwords, bank details, and personal records linked to previous data breaches and leaks were exposed in an unsecured database.
Cybersecurity researcher Jeremiah Fowler discovered the repository and the linked records to major companies and institutions, including AT&T, Amazon, Walmart, PayPal, the FBI, and Interpol.
Among 13.7 million leaked records, there was:
- Email addresses
- Usernames
- Passwords
- Phone numbers
- Bank account details
The database was connected to an IP address associated with a data intelligence platform operated or developed by Vibetech, an India-based AI software development and IT services company, Fowler reported.
According to its website, Vibetech is an AI-powered platform that helps users develop their artificial intelligence skills through tools, prompts, and personalized matching.
Millions of credentials collected from past breaches
The exposed repository contained references to numerous datasets associated with previously reported breaches and leaked information. Among the largest collections were:
- AT&T data leak: 7.9 million records
- Gambling Private Combo: 2.24 million records
- Casio.ru data breach: 1.71 million records
- Amazon Private Combo: 1.21 million records
- Walmart Private Combo: 420,368 records
- Spain WhatsApp database: 98,325 records
- BluBank digital bank leak: 24,021 records
- PayPal Private Combo: 18,157 records
- FBI employee directory: 4,084 records
- Interpol data leak: 929 records
The dataset also referenced a Belgian database containing personal information and International Bank Account Numbers (IBANs), as well as a database associated with a university in Kuwait.
Fowler said in the report that some records appeared to correspond to previously disclosed incidents, while others did not match known public record counts.
This may indicate that some of the records are coming from previously unknown breaches.
“I immediately sent a responsible disclosure notice to the company connected to the IP address. I also notified the hosting provider, after which the database was restricted and no longer publicly accessible,” Fowler said.
The duration of the exposure and whether there was any prior access by the threat actors are unknown, so the full extent of the potential risk remains unclear.
Why old passwords can still put people at risk
A password exposed in an old breach might seem like yesterday's problem. However, for cybercriminals, it can still be useful years later.
“One of the most common misconceptions about historical data breaches is that older credentials eventually lose their value. In reality, previously exposed information can remain useful to criminals years after the original incident,” Fowler warned.
A searchable database with millions of records in one place is very convenient for attackers looking for potential targets. Otherwise, such data would be scattered across underground forums and marketplaces.
Exposed data could be exploited in credential stuffing attacks. Attackers routinely try stolen username and password combinations against other services, hoping victims have reused their credentials.
Also, exposed data could be used for social engineering and phishing attacks. An email address, phone number, and bank account details can help criminals craft a convincing phishing message.
The risks of collecting stolen data
Research does not specify the connection between the company’s services and the exposed credential repository.
Companies collect and analyze breached credentials for a variety of purposes, including threat intelligence, security research, and monitoring for compromised accounts.
“Although these datasets can provide valuable insights into attack trends, credential reuse, and emerging threats, organizations that collect compromised personal information operate in a legally and ethically complex environment,” Fowler said.
Aggregating sensitive information also creates another repository that must be secured.
According to Fowler, if the collected material is stored without adequate access controls, the resulting exposure can extend the potential harm of the original breaches.
How to stay safe
- Change passwords for all affected accounts and any other accounts that share the same credentials.
- Use a different, strong password for every service, ideally generated and stored with a reputable password manager.
- Enable multi-factor authentication (MFA) wherever possible. This adds another layer of protection if a password is stolen.
- Be cautious with unexpected emails, text messages, and phone calls that reference personal details present in the leak. Information from historical breaches can make fraudulent messages appear legitimate.
- If a message requests sensitive information or urges a money transfer, verify the request through an official contact channel rather than relying on the contact details or links provided in the message.
