AI development company re-exposed nearly 14 million breached credential records
Upon further investigation, I found that the IP address was connected to a data intelligence platform operated or developed by Vibetech, an India-based AI software development and IT services company. The platform aggregated credential datasets from previous breaches or leaks and made them publicly accessible without authentication.
Although the information appears to have originated from earlier security incidents involving other organizations and individuals around the world, publicly re-exposing these records could significantly increase the risk faced by the people and organizations whose information was included in the collection. Some of the data could be linked to previously disclosed breaches, while other datasets did not match known total record counts exposed in known public disclosures. These may have been combined datasets or potentially previously unknown breaches.
I immediately sent a responsible disclosure notice to the company connected to the IP address. I also notified the hosting provider, after which the database was restricted and no longer publicly accessible. The following day, the IP address no longer hosted the plaintext credentials and instead displayed an Information Security Management System (ISMS) compliance platform dashboard.
An ISMS is a risk-based framework that helps an organization establish, operate, and monitor controls designed to systematically manage and protect its sensitive data. The platform appears to have been an internal project or perhaps one created as a development contractor for a third party client. It is not known how long the data was exposed or whether anyone else accessed it. Only an internal security audit could identify any additional access.
Numerous organizations operate under the common name Vibetech. The IP address and security platform in question are connected to a .in domain and are not affiliated with other companies that use the same name. According to its website, Vibetech is an AI-powered platform that helps users master artificial intelligence by providing tools, prompts, and personalized matching. It is not known how the company sourced or obtained these credentials.
The exposed repository contained references to numerous breached datasets, including:
- AT&T Data Leak — 7,910,431 records
- Gambling Private Combo — 2,241,617 records
- casio.ru Data Breach — 1,714,752 records
- Amazon Private Combo — 1,210,905 records
- Walmart Private Combo — 420,368 records
- Spain 102K WhatsApp Database — 98,325 records
- BluBank Digital Bank Leak — 24,021 records
- PayPal Private Combo — 18,157 records
- arabou.edu.kw Customer Database — 18,107 records
- Belgium Full Information and IBAN Database — 6,601 records
- FBI Employee Directory — 4,084 records
- Interpol Data Leak — 929 records
- Student Educational Directory — 71 records
This screenshot shows how records containing emails, usernames, and passwords appeared in the exposed database.
This screenshot shows the exposed threat intelligence dashboard hosted on the same IP address as the database.
This screenshot shows how the raw data appeared and how it could be viewed and queried using nothing more than a web browser.
Why re-exposed data still poses new risks
Although this information may previously have been for sale on the dark web or underground forums, centralizing millions of records in a single searchable repository dramatically increases their accessibility and lowers the technical barrier for cybercriminals. Information that may once have required searching multiple underground marketplaces or private communities could become available through a single interface. When collections of breached data are exposed in this way, they create a serious threat to affected individuals.
One of the most common misconceptions about historical data breaches is that older credentials eventually lose their value. In reality, previously exposed information can remain useful to criminals years after the original incident. Criminals often use historical breach data to identify potential victims. Known email addresses can be combined with publicly available information, social media profiles, and newly compromised credentials to carry out phishing attacks, business email compromise (BEC), identity theft, and targeted social engineering campaigns.
BEC is a high-loss category of cybercrime and a prime focus for cybercriminals. According to the Internet Crime Complaint Center (IC3), losses from BEC reached $2.77 billion USD in 2024. An estimated 75% of business email addresses contain either a full first name, full last name, or both. In many cases, criminals do not need to know an account’s password if they already know that a specific email address belongs to an individual. Appearing in a previous data breach may therefore increase the likelihood that an email account’s owner will be targeted in the future.
Unfortunately, many individuals are never informed that their personal information was included in a breach. Others may have changed their passwords but continue to use the same email address across multiple online accounts. While changing a password can reduce the risk of credential-based attacks, an exposed email address remains a valuable source of intelligence. According to a survey conducted by TechRadar, 84% of participants said that changed their passwords only when forced to or after forgetting them
Companies collect breached data
Cybercriminals often use breached data as working lists for fraud and other malicious activities. At the same time, a growing number of organizations intentionally collect and sell breached credential datasets for research, monitoring, or threat intelligence purposes. Although these datasets can provide valuable insights into attack trends, credential reuse, and emerging threats, organizations that collect compromised personal information operate in a legally and ethically complex environment.
Information originating from criminal activity, unauthorized access, or illicit data trafficking can create additional legal risks and liabilities. Managing this data also carries a significant responsibility to protect it. Re-exposing previously compromised personal information, even when the intent is legitimate research, can increase the potential harm long after the original data breach by making sensitive data more accessible to cybercriminals.
India has data protection laws, including the Digital Personal Data Protection (DPDP) Act and the Information Technology (IT) Act, 2000, that are relevant to how credentials and other personally identifiable information (PII) are handled. Legal commentators have noted that cybersecurity firms operating in India often work under client authorization when identifying and remediating exposed data, using it for defensive threat intelligence rather than fraud or extortion. I am not suggesting that Vibetech engaged in any activity beyond legitimate research purposes, nor am I making any claims about how these laws apply to the exposed credentials referenced in this report.
The global breached credential monitoring market was valued at an estimated $1.94 billion USD in 2024 and is expected to grow to $8.06 billion by 2033. As more companies enter a market in which compromised data is the primary product, breached records may become increasingly valuable. This could also increase the risk of secondary exposure as more organizations store vast amounts of sensitive data. The more companies that operate in this industry, the greater the likelihood that such data will be exposed through vulnerabilities, weak or nonexistent access controls, misconfigured cloud storage, unsecured databases, or even publicly accessible APIs.
Potential risks
Organizations that provide breach intelligence or similar services should treat cloud storage repositories as highly sensitive assets. Cybercriminals could use exposed username and password combinations to conduct credential-stuffing attacks against other online services, while known email addresses could support large-scale phishing campaigns and targeted social engineering attacks. They could also correlate information from multiple historical breaches to build detailed profiles of individuals, potentially facilitating identity theft, BEC, financial fraud, and password-reset attacks.
Government agencies, educational institutions, and private organizations could also face increased intelligence-gathering efforts targeting their employees if identifiable account information were exposed. Large collections of exposed email addresses, usernames, telephone numbers, account identifiers, and metadata could contribute to future cyberattacks.
Recommendations for individuals
I recommend that anyone who believes their information may have been exposed in a data breach take steps to reduce the risk of future account compromise. This includes changing the passwords for potentially compromised accounts and any other accounts that use the same passwords, using unique passwords for every online service, and enabling multi-factor authentication (MFA) whenever available. A password manager can help you create and store complex, unique passwords for multiple accounts.
Be cautious of unsolicited emails, text messages, or phone calls requesting personal or financial information. Modern phishing campaigns may reference previous purchases, employers, or online accounts to appear convincing. Always verify that the individual or company requesting information is who they claim to be, and communicate only through official channels.
Potential legal and regulatory considerations
Organizations that collect and aggregate previously breached credential data assume legal and regulatory responsibilities for protecting that information, regardless of where it originated. Regulators may view its re-exposure as a separate data breach requiring compliance with applicable privacy laws, security safeguards, and, where applicable, breach notification obligations. Because these datasets contain the personal information of individuals from multiple countries, organizations may also be subject to overlapping international privacy regulations and data protection requirements.
I do not allege any wrongdoing by Vibetech India or any of its contractors, affiliates, or related entities. Nor do I claim that user data was ever at imminent risk as a result of this specific exposure. It is unknown whether the breached credentials were exploited in other instances before this collection was exposed. The hypothetical data-risk scenarios presented in this report are strictly for educational purposes and do not reflect, suggest, or imply any actual compromise of data integrity or illegal activity. This report should not be construed as an assessment of or commentary on any organization’s specific practices, systems, or security measures.
As an ethical security researcher, I do not download the data I discover. I take only a limited number of screenshots when necessary and solely for verification and documentation. I do not conduct any activities beyond identifying the security vulnerability and notifying the relevant parties. I disclaim any liability for actions taken as a result of this disclosure. I publish my findings to raise awareness of data security and privacy issues and encourage organizations to proactively safeguard sensitive information against unauthorized access.
