Cyber & AI intelligence
Wasteland.
Briefs indexed3476
Issues33
Published Mondays07:30 CT
▣ Breach VIBETECH-EXPOSED-D 2026-10-15

Vibetech: Unsecured Database Re-Exposes 13.7M Breached Credential Records

"A database with no password and no encryption, linked to Vibetech, was left open to anyone on the internet. Vibetech is an India-based company that builds AI software and sells IT services. The database held about 13.7…"

A database with no password and no encryption, linked to Vibetech, was left open to anyone on the internet. Vibetech is an India-based company that builds AI software and sells IT services. The database held about 13.7 million records collected from earlier data breaches and leaks. Security researcher Jeremiah Fowler found it, and his report was published by ExpressVPN. Every outlet covering the incident uses the same 13.7 million figure. TechRadar and Security Magazine describe it as "almost 14 million" or "14M" in their headlines, which is rounding rather than a conflicting count. The records include names, email addresses, phone numbers, passwords (stored in plain text, according to The Modern and BeyondMachines) and bank account details for people in several countries. None of the sources include a statement from Vibetech, a regulator filing or a national CERT advisory. Every account comes from the researcher's disclosure and the press coverage built on it.

What Happened

Fowler says he found a publicly reachable database that was "neither password-protected nor encrypted." He traced its IP address to a data intelligence platform "operated or developed by" Vibetech. BeyondMachines reports that the IP address linked to a .in domain associated with the company. According to BeyondMachines and Cybernews, the same server hosted a threat intelligence dashboard that made the collected records searchable. Abijita reports that anyone with the address could view and query the data in a web browser.

Fowler sent a responsible disclosure notice to Vibetech and also notified the hosting provider. Access was restricted after that. The next day, the IP address no longer served the credentials. It showed an Information Security Management System (ISMS) compliance dashboard instead. Fowler suggests the platform may have been an internal project, or one Vibetech built as a contractor for a third-party client. That has not been confirmed. The Modern dates the disclosure to 12 October 2026, which matches the publication date of Fowler's report. No other source gives that date.

Several important points are still unknown: how long the database was exposed, whether anyone else accessed it, and how Vibetech obtained the datasets. Cybernews describes Vibetech's public product as an AI-powered platform that helps users build AI skills, which does not obviously match a breach-data aggregation tool. Vibetech has not publicly explained the discrepancy.

What Was Taken

The Modern and SMBtech both itemise the datasets by their labels in the database. Their figures match:

These itemised datasets add up to about 13.67 million records, which is consistent with the 13.7 million headline figure. The data types reported across sources are full names, usernames, email addresses, passwords, phone numbers, bank account and IBAN details, account metadata, and employee and customer records. BeyondMachines also lists home addresses and location data. The Modern reports that an "Intelligence Insights" panel on the dashboard said email credentials made up 72.1% of records. No other source reports that figure.

The labels show what the data claims to be, not where it actually came from. A "Private Combo" set is a combo list: credentials compiled from many sources, not records taken from the named company. The AT&T, Amazon, Walmart and PayPal labels should not be read as new breaches of those companies. Fowler notes that some datasets match breaches already disclosed, while others "did not match known total record counts." That could mean they are merged collections, or possibly breaches nobody has reported yet. BeyondMachines notes that the number of unique individuals has not been confirmed, because breach compilations usually contain many duplicates.

Why It Matters

This was not a new compromise. It was old breach data collected in one place, sorted, and made easy to search. That still increases the risk. Security Magazine points out that putting old breach data into one easily explored database lowers the effort needed to target victims, and that old credentials "retain value for years." Plaintext passwords next to email addresses are ready to use in credential stuffing. Bank and IBAN data, plus sets labelled as FBI and Interpol directories, are useful for targeted phishing, business email compromise and social engineering against government and law enforcement staff.

There is also a wider pattern. More companies now build "threat intelligence" or "data intelligence" products by collecting breach data, and those collections become high-value targets themselves. A firm that stores stolen credentials, even for defensive reasons, is responsible for securing them at least as well as the original victims should have. In this case the store was apparently a development or compliance project, and nothing protected it.

The Attack Technique

No attacker or intrusion has been identified. The exposure came from a misconfiguration: a data store and its web dashboard were deployed on a public IP address with no login and no encryption. Anyone who found the address, including through routine internet scanning, could browse and search the records. Fowler found it this way. Nobody has determined whether malicious actors found it before he did. Abijita notes that answering that would require Vibetech to investigate internally and review its access logs. The company has not said publicly whether it has done so.

What Organizations Should Do

  1. Check exposure against the named datasets. Compare corporate email domains against breach-monitoring feeds. Prioritise accounts that may appear in AT&T-, Amazon-, Walmart-, PayPal- or government-labelled combo lists. Force password resets for any matches.
  2. Block credential stuffing. Screen passwords against known-breached lists when users log in or reset them. Rate-limit and fingerprint login attempts, and watch for spikes in failed logins across many accounts.
  3. Require phishing-resistant MFA. Old passwords only matter where a password alone is enough to log in. Prioritise email, VPN, finance and admin accounts.
  4. Prepare finance teams for targeted fraud. Bank and IBAN details make invoice-redirection and business email compromise attempts more convincing. Require verification through a separate channel for any change to payment details.
  5. Audit your own internet-facing data stores. Scan regularly for databases, search clusters and dashboards reachable without authentication, especially development, staging and contractor-built systems. Make authentication and encryption a requirement before deployment.
  6. Hold vendors to account for breach data they keep. If a threat intelligence or security vendor stores breach data on your behalf, ask in writing how it is stored, who can access it, and how long logs are kept.

Sources: Massive data leak from AI development company exposes almost 14 mil... | Vibetech Database Exposed 13.7 Million Credential Records | AI company exposed 13.7 million breached records Cybernews | Millions of Exposed Passwords Found in Publicly Accessible Database... | Indian IT firm left 13.7 million breached credentials open… The Mo... | Researcher Finds 13.7 Million Breached Credentials Sitting In An Un... | Unsecured Vibetech-Linked Database Exposes 13.7 Million Breach Records | 14M Credentials Re-Exposed by AI Development Company Security Maga...