Overview

• Cybersecurity researcher Jeremiah Fowler discovered the 47 GB plaintext database in early May, exposing 184,162,718 unique logins for platforms including Google, Microsoft, Facebook, banking services and government portals.
• Forensic analysis indicates the credentials were harvested by infostealer malware that captured stored passwords, autofill data and cookies from infected devices.
• The database lacked encryption and password protection, leaving sensitive account information accessible to anyone who found it.
• World Host Group removed the exposed files after Fowler’s notification, but the database owner’s identity and purpose—whether research or criminal—remain undetermined.
• Experts advise users to reset affected passwords, enable two-factor authentication and monitor accounts for suspicious activity to guard against credential stuffing and identity theft.