What Data Was Exposed?  

These records are spread across 30 databases. Some may be overlapping; still, this exposure could enable malicious actors to exploit the credentials for identity theft, account takeovers, and targeted phishing attacks. The potential overlap makes it currently impossible to determine how many individuals may be affected.

According to the research, the information followed a typical structure for most infostealers: a URL, followed by login details and a password. 

The leaked information could compromise a wide range of services, such as Apple, Facebook, and Google. However, the research warns that virtually any online service could be at risk. 

“The inclusion of both old and recent infostealer logs — often with tokens, cookies, and metadata — makes this data particularly dangerous for organizations lacking multi-factor authentication or credential hygiene practices,” the research team comments.

Implications of the Record-Breaking Breach

Cybernews researcher Aras Nazarovas argues that this breach could signal a shift in the way malicious actors are acquiring stolen data.

Nazarovas says, “The increased number of exposed infostealer datasets in the form of centralized, traditional databases, like the ones found be the Cybernews research team, may be a sign, that cybercriminals are actively shifting from previously popular alternatives such as Telegram groups, which were previously the go-to place for obtaining data collected by infostealer malware.”

An update on this story can be found here.