149 Million Exposed: The Hidden Toll of Infostealing Malware

A researcher stumbled upon a 149-million-account treasure trove of exposed credentials—government, banking, and streaming platforms alike—hosted in plain sight on a Canadian server.

A database containing 149 million exposed account credentials (48M Gmail, 17M Facebook, 420K Binance) was removed after security researcher Jeremiah Fowler reported it to the hosting provider.

The database included government systems, banking, credit card, and streaming platform logins, with data growing during Fowler’s month-long attempt to contact the host. 780K TikTok, 100K OnlyFans, and 3.4M Netflix credentials were among the exposed accounts. The data was publicly accessible via a web browser without authentication.

"This is like a dream wish list for criminals, because you have so many different types of credentials," says Fowler. The database was hosted by a regional affiliate of a global provider in Canada and organized with unique identifiers for easy querying.

Recorded Future’s Allan Liska noted that infostealers create a very low barrier of entry for new criminals. "Infostealer infrastructure costs $200–$300/month," he said, highlighting the affordability of cybercrime tools.