14M Credentials Re-Exposed by AI Development Company
13.7 million records were exposed by a database with no encryption or password protection. In this database was a collection of sensitive data compromised in previous breaches, including but not limited to:
- Names
- Email addresses
- Phone numbers
- Passwords
- Bank account data
Cybersecurity Researcher Jeremiah Fowler, who discovered the database, then determined the IP address was linked to a data intelligence platform associated with Vibetech. Vibetech is an IT services and AI software development organization based in India.
The company collected credentials from prior breaches and made them accessible to the public without authentication. Some of the breached datasets included were the AT&T breach and the FBI employee directory breach.
Does Re-Exposed Data Pose New Risks?
Much of the data in this exposed repository was previously breached. So, is there really a concern with it being exposed again?
Unfortunately, there is.
Centralizing these records into an accessible, easily-explorable database makes it easy for people to gain access to them — including cybercriminals. While some may think older credentials lose value, the reality is that they can retain value for years, as malicious actors leverage historical breach data in order to identify victims.
At this time, it is unclear if the exposed database was accessed by malicious actors prior to Fowler's discovery.
Looking for a reprint of this article?
From high-res PDFs to custom plaques, order your copy today!
