A security report detailing the exposure of nearly 149 million stolen usernames and passwords is a clear signal that cybersecurity failures, especially those involving credential leaks, are now inseparable from customer trust and digital experience strategy.
The findings, uncovered by cybersecurity researcher Jeremiah Fowler and shared with ExpressVPN, describe a publicly accessible database containing 149,404,754 unique logins and passwords, totaling 96 GB of raw data.
The database was not password-protected or encrypted and could be accessed using a standard web browser. Fowler wrote:
“This is not the first dataset of this kind I have discovered and it only highlights the global threat posed by credential-stealing malware.”
The exposed data appears to have been collected by infostealer malware, designed to harvest credentials, session data and other sensitive information from infected devices.
A CX Crisis Hiding in Plain Sight
The scale and composition of the exposed data is especially concerning. The credential leak spanned consumer, entertainment, financial, and government-linked services, including social platforms, streaming providers, dating apps, financial services, crypto exchanges, and email providers.
In a limited sample, Fowler saw credentials tied to services such as Facebook, Instagram, TikTok, X, OnlyFans, Netflix, HBOmax, DisneyPlus, and Roblox. Even more concerning was the fact that the credentials included accounts associated with .gov domains in numerous countries, which could have serious implications depending on the role of the compromised user.
For customers of the various platforms, credential exposure can lead to account lockouts, fraud alerts, forced password resets, and heightened friction, directly degrading experience and eroding confidence in brands. Even when a company is not the original source of the breach, customers tend to associate the pain with the service they can see.
The exposed email addresses and account associations could allow criminals to build detailed profiles of individuals. Knowing where they have accounts, what services they use, and potentially their professional or personal affiliations could increase the success rate of social engineering or phishing attempts.
“The exposure of such a large number of unique logins and passwords presents a potentially serious security risk to a large number of individuals who may not know their information was stolen or exposed,” Fowler wrote.
“This dramatically increases the likelihood of fraud, potential identity theft, financial crimes, and phishing campaigns that could appear legitimate because they reference real accounts and services.”
Unlike previous datasets Fowler has investigated, this credential leak included structured metadata such as reversed host paths and hashed document IDs, making the stolen data highly searchable and automation-ready.
The same technologies that customer-facing teams use to personalize journeys and reduce friction can also be used by attackers to launch large-scale credential-stuffing attacks across services at machine speed.
