Published on: May 30, 2025
A massive 47 GB database leak has exposed over 184 million user records, including login details for Microsoft, Google, and Apple accounts, as well as government and corporate emails from at least 29 countries. The data, which included sensitive credentials for banking, health, and government services, could put millions at risk of identity theft and cybercrime.
Cybersecurity researcher Jeremiah Fowler discovered the open Elasticsearch database and quickly reported it to Website Planet. The database, which had no password protection or encryption, was taken offline shortly after. But it’s unclear how long it was exposed or whether anyone accessed or downloaded it before it was secured.
Fowler’s findings revealed entries tied to major platforms like Facebook, PayPal, and Netflix, and more than 220 government-related email addresses from countries including the US, UK, and China. He warned that the records could have come from devices infected with infostealer malware, but stressed that he found no direct evidence of ongoing abuse.
World Host Group, the hosting provider, confirmed to WIRED that the database was on a client-controlled server and is now working with legal teams and law enforcement. They declined to reveal the identity of the customer responsible.
While the leak is no longer active, its unknown duration of exposure means the damage may already be done. Users are urged to monitor accounts, update passwords, and use two-factor authentication wherever possible.
Fowler highlighted the unique circumstances of this breach: “This is probably one of the weirdest ones I’ve found in many years. As far as the risk factor here, this is way bigger than most of the stuff I find, because this is direct access into individual accounts. This is a cybercriminal’s dream working list.”