A publicly accessible database exposed 13.7 million credentials alongside names, phone numbers, email addresses, passwords and apparent bank-account details, according to cybersecurity researcher Jeremiah Fowler and ExpressVPN.
Fowler said the database appeared to be connected to Vibetech, an India-based AI software development and IT services company. Some records appeared to have been assembled from earlier security incidents, while other data could not be matched to known public breach disclosures. The ownership and original source of every record have not been independently established.
Aggregated credential collections create risk even when individual entries are old. Reused passwords can still unlock business systems, while names, phone numbers and financial details give criminals material for account recovery fraud, phishing and identity theft. Republishing previously stolen data also extends the life of an earlier compromise.
Organizations should monitor for credential exposure, force resets where affected accounts can be identified and block known compromised passwords at enrollment. Multifactor authentication and device-aware access controls can reduce the value of a stolen password, but users should also watch for targeted scams that use the surrounding personal data to appear credible.
