A database containing nearly 14 million records from previous data breaches was left accessible to anyone with an internet connection, potentially exposing sensitive information belonging to people around the world.
The discovery was made by cybersecurity researcher Jeremiah Fowler, who published his findings through ExpressVPN on October 12, 2026. The database contained approximately 13.7 million records, including email addresses, usernames, passwords, phone numbers, and banking information.
According to ExpressVPN’s investigation, the database was neither password-protected nor encrypted. This meant that its contents could be viewed through a web browser without logging in or bypassing security controls.
Fowler traced the exposed server to a data intelligence platform connected to Vibetech, an India-based company involved in AI software development and IT services. The platform appeared to collect information from numerous previously compromised databases.
The records included collections labeled as originating from AT&T, Amazon, Walmart, PayPal, and other organizations. One dataset associated with AT&T contained approximately 7.9 million records, while another labeled as an Amazon credential collection contained more than 1.2 million.
Importantly, these labels do not establish that the named companies suffered new security breaches. The information largely appeared to come from older incidents, although ExpressVPN noted that some datasets did not match publicly known breach totals.
The source of the collected information remains unclear. Researchers have not established how Vibetech obtained the records or whether the platform was developed for internal use or a third-party customer.
Following the discovery, Fowler notified the organization associated with the server and its hosting provider. Access to the database was subsequently restricted, and the exposed credentials were no longer publicly visible.
However, ExpressVPN’s report states that it is unknown how long the information remained accessible or whether unauthorized individuals downloaded it before the database was secured.
Even when stolen information comes from older breaches, exposing it again can create additional risks. Criminals may combine email addresses, passwords, and personal details to attempt account takeovers, impersonation scams, or convincing phishing attacks.
For example, someone who reused an old password across several websites could still be vulnerable if that password appeared in the exposed collection.
ExpressVPN recommends changing potentially compromised passwords, avoiding password reuse, and enabling two-factor authentication wherever possible. Users should also be cautious of unexpected messages requesting personal or financial information.