An unprotected database linked to India-based AI software development and IT services company Vibetech exposed 13.7 million records containing credentials and other sensitive information from previous data breaches.
The repository was accessible online without security authentication or a password, according to cybersecurity researcher Jeremiah Fowler, whose findings were published by ExpressVPN and shared with Hackread.com.
The database contained names, phone numbers, email addresses, plaintext passwords, and bank account details. Fowler linked the server’s IP address to a data intelligence platform operated or developed by Vibetech that appeared to aggregate datasets from earlier breaches and leaks.
Exposed Datasets and Incident Response
The repository referenced numerous compromised collections, including:
- Interpol Data Leak: 929 records
- AT&T Data Leak: 7,910,431 records
- FBI Employee Directory: 4,084 records
- Casio.ru Data Breach: 1,714,752 records
- Walmart Private Combo: 420,368 records
- Amazon Private Combo: 1,210,905 records
- BluBank Digital Bank Leak: 24,021 records
- Gambling Private Combo: 2,241,617 records
Fowler immediately submitted a responsible disclosure notice to Vibetech and notified the hosting provider. The database was restricted shortly after. The following day, the same IP address displayed an ISMS compliance dashboard and not the exposed passwords.
“An ISMS is a risk-based framework that helps an organization establish, operate, and monitor controls designed to systematically manage and protect its sensitive data,” Fowler explained in his blog post.
It is unknown how long the repository remained exposed or if unauthorized parties accessed it before remediation.
Risks of Re-Exposed Credentials
The risks of exposed databases containing records of stolen credentials are far more than mere account takeovers. Cybercriminals may use exposed passwords to access email, shopping, or financial accounts, steal personal information, make fraudulent purchases, or impersonate victims. Phone numbers and bank details can also help them create convincing scams.
Hackread.com has reported on similar risks, including a September 2026 report explaining how leaked email addresses can help criminals carry out phishing and account takeovers.
In another report, Hackread.com covered an Instagram recovery-tool flaw that exposed 20,225 accounts to password-reset abuse. These cases show how exposed information and weaknesses in account recovery can put users’ accounts at risk.
