Vibetech database exposed almost 14 million records online

A database containing 13.7 million records from previous breaches was left accessible online and linked to data intelligence platform Vibetech, according to security researcher Jeremiah Fowler, whose findings were reported by TechRadar. The records included names, phone numbers, email addresses, passwords and bank account details. Fowler said a limited sample contained accounts and credentials from multiple countries.

Almost 8 million records were attributed to an AT&T leak. The archive also included 1.2 million records from Amazon, 420,000 from Walmart, 24,000 from BluBank Digital Bank and 18,000 from PayPal. Smaller collections included 4,084 records from an FBI Employee Directory and 929 from Interpol.

Fowler said the database’s IP address was connected to a platform operated or developed by Vibetech. He speculated that the company had gathered datasets from earlier breaches or leaks and made them accessible without authentication. After Fowler notified Vibetech and the hosting provider, access to the database was restricted. A day later, the IP address displayed an Information Security Management System (ISMS) compliance dashboard instead of plaintext credentials.

Fowler said organizations collect breached credential datasets for research, monitoring or threat intelligence, but described the practice as legally and ethically complex. The report also cited earlier exposed databases: one discovered in early 2024 contained information on approximately 223 million Brazilians, and a 2021 leak involved personal information on up to 126 million US citizens.