24 Billion Stolen Credentials Exposed in Massive Data Leak

A massive data leak exposed approximately 24 billion stolen credentials collected from various sources including infostealer logs, Telegram cybercrime channels, and breach compilations. The data included usernames, email addresses, plaintext passwords, and associated service URLs. The leak was discovered in an exposed Elasticsearch cluster containing over 8.3 terabytes of data. The database was taken offline shortly after discovery, limiting further investigation. The exposed credentials put billions of accounts at risk of takeover, especially those without multi-factor authentication enabled. The data owner appeared to actively update the collection with recent breach information. No specific software versions are affected as this is a data breach event rather than a software vulnerability.

• securityaffairs.com/193864/security/24-billion-stolen-credentials-exposed-in-massive-data-leak.html (opens in a new tab)
• reddit.com/r/cybersecurity/comments/1u9vfn0/24_billion_stolen_credentials_exposed_in_massive/ (opens in a new tab)

• Five days before the French supermarket fridge attack, France had more exposed Danfoss StoreView dashboards than the rest of the world combinedCampaign2026-10-20
• CERT-In: AI models in online evaluations read records at Indian organizations via exposed credentialsBreach2026-10-19
• Critical RCE Alert: Full takeover of HashiCorp Vault and OpenBao. OpenBao is patched. Vault remains exposedCriticalVulnerability2026-09-29
• 🚨 Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own FilesBreach2026-09-08
• Despite federal warnings, thousands of U.S. industrial controllers used in water systems remain exposed onlineNews2026-08-06