A publicly exposed Elasticsearch database gave anyone with a web browser free access to 24 billion stolen credential records in June 2026, according to research Cybernews published on June 12. No login. No password. Just an open port and a search bar.
The database held more than 8.3 terabytes of data: usernames, email addresses, plaintext passwords, and the exact web addresses where each credential pair worked. Researchers found it, verified the numbers, and watched it disappear from public view by June 15. The data inside had already been circulating in criminal channels for months, and taking one exposed server offline did nothing to stop the pipeline that filled it.
This wasn’t a single company’s breach. It was closer to a warehouse inventory: 36 separate sources of stolen logins, most scraped from malware-infected devices and traded across more than 30 Telegram channels, compiled into one searchable index. Researchers who track breach compilations called it one of the largest credential databases ever left exposed online. Whether it beats the 2024 “Mother of All Breaches” on raw record count is almost beside the point. What makes this leak worse is what’s attached to each password: a link telling an attacker exactly where to use it.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Cybernews Found Inside the Exposed Server
Cybernews researchers found the database while scanning for open, unauthenticated instances of Elasticsearch, a search and analytics tool that companies, and criminal groups, use to index huge volumes of data quickly. This particular instance required no credentials of its own to browse. Anyone who found the IP address could query 24 billion records the same way an analyst might query a corporate log server.
The team verified the total record count multiple times before publishing, given how easily leak databases can be padded with duplicates or junk entries. Even accounting for that caution, this ranks among the largest single collections of stolen credentials ever found sitting in the open, alongside the 26-billion-record “Mother of All Breaches” compilation that researcher Bob Dyachenko and Cybernews uncovered in January 2024.
The server went dark within three days of discovery, on June 15. Nobody has claimed ownership of it, and Cybernews said the operator’s identity remains unknown. That’s typical for this kind of exposure. The database likely belonged to a criminal marketplace, a log-reselling operation, or an aggregator tool built to make stolen credentials searchable for buyers, not a legitimate business that simply left the door open, as detailed in Malwarebytes’ write-up of the leak.
The Exposure Window: Why Three Days Undersells the Real Timeline
Cybernews found the exposed server on June 12, 2026, and it went dark by June 15, a three-day window that sounds almost responsible by industry standards. Compare that to breaches that sit exposed for months before anyone notices. But the three-day figure measures the wrong window entirely.
By the time researchers found this particular Elasticsearch instance, the data inside it had already been circulating in criminal channels for months. The database wasn’t the origin of the exposure. It was a snapshot of an ongoing criminal supply chain, one node in a longer pipeline that started with infostealer malware harvesting individual browsers, moved through Telegram channels trading logs in smaller batches, and ended with someone compiling 36 of those sources into a single searchable index. Taking that index offline on June 15 didn’t touch any of the earlier steps in the chain.
That’s the uncomfortable math behind most exposed-database stories. Three days measures how long this particular aggregation point stayed visible to researchers, not how long the underlying credentials had already been available to criminals. A password that surfaced in this database in June could have been sold, traded, or used months earlier in a Telegram channel or a private marketplace that never made headlines. The useful question isn’t how fast the server got taken down. It’s how long the password inside it was already circulating before it landed somewhere researchers could find it.
As of August 2026, nobody has stepped forward to claim the server, and Cybernews’ original assessment, that the operator’s identity remains unknown, still holds nearly two months later.
Breaking Down the 8.3 Terabytes: Where the Data Came From
The database wasn’t one leak. It was 36 of them, stitched together. More than 30 of the 36 sources traced back to Telegram channels, the platform that has become the dominant marketplace for stolen data since messaging-app-based cybercrime took off in the early 2020s.
Most of the volume, 22.6 billion records, came from entries researchers labeled simply as “collections,” generic aggregated dumps without one clear origin. The smaller categories tell a more specific story. Roughly 260 million records traced to Telegram channels using some variation of the name “Darkside,” 150 million came from what researchers labeled “local database dumps,” and 146 million were tagged “breach compilation combo,” the industry term for recycled credential lists assembled from older leaks, according to Security Affairs’ breakdown of the dataset.
Zoom out from those individual buckets and a different pattern shows up. Broader reporting on the dataset attributes roughly 1.7 billion records, a figure that folds in the 260-million-record Darkside cluster, to Telegram channels dedicated specifically to hacking and credential trading, as opposed to the 22.6 billion parked in the catch-all “collections” category. That distinction matters more than it sounds. A record sitting in an unlabeled collections dump could have come from almost anywhere. A record traced to a named, active hacking channel points to a specific piece of criminal infrastructure that’s still running and still trading.
A few entries stood out as evidence of just how indiscriminate infostealer malware can be. The database contained more than 17,000 records referencing CVE vulnerability IDs paired with GitHub links, plus over 5,200 logs pulled from breach-news articles and roughly 2,900 logs of cybersecurity social media posts. The malware behind this data didn’t just steal banking logins. It scraped browser history and saved credentials from security researchers’ own machines, proof that researchers are just as capable of clicking the wrong download link as anyone else.
Every record included the same core fields: username or email, plaintext password, the login URL it belonged to, and metadata pointing back to its source.
Why the Source Breakdown Matters More Than the Headline Number
The 24-billion figure is the headline, but it’s the wrong number to focus on when the goal is deciding what to actually do about this leak. Most of that total, the 22.6 billion records filed under “collections,” is functionally unattributed. Researchers can say it came from infostealer malware in general. They can’t say which strain, which campaign, or which criminal group is actively trading it right now. That’s archival data in the loosest sense: real and dangerous, but hard to act on.
The channel-attributed slice is smaller and more useful. The roughly 1.7 billion records tied to hacking-focused Telegram channels, including the 260-million-record Darkside cluster, point to specific, ongoing distribution points rather than a static dump. Security researchers who monitor those channels can watch what gets posted, track which domains show up most often, and flag active campaigns before the stolen credentials get folded into the next mega-database. That’s the difference between forensics and threat intelligence: one explains what already happened, the other flags what’s happening right now.
It’s also why comparing this leak to something like the 2024 Mother of All Breaches on record count alone misses the point. MOAB was almost entirely archival, a compilation of compilations. This database’s channel-sourced records look more like a live feed. For a security team deciding where to spend limited monitoring budget, a 1.7-billion-record slice tied to active criminal channels is a better lead than a 22.6-billion-record slice with no clear source. Scale matters less than traceability once a leak gets this large.
None of this makes the “collections” portion of the database safe to ignore. It just means the response looks different: broad password resets and breach-monitoring checks for the bulk of the data, and more targeted threat-intelligence monitoring for the channel-sourced slice that’s still actively feeding new criminal activity.
How a Database This Size Ends Up Exposed to Anyone With a Browser
Elasticsearch and similar NoSQL tools ship without authentication turned on by default. That’s fine for a developer testing something locally. It becomes a liability the moment that same instance gets deployed to a public cloud server and nobody remembers to lock it down, a pattern TechRepublic’s reporting on the leak flagged as a recurring failure across similar incidents.
This is not a new failure mode. Researchers have been finding exposed Elasticsearch, MongoDB, and Kibana instances loaded with stolen data for years, and the 2024 Mother of All Breaches turned up the exact same way, through an open, unsecured server that anyone could query without logging in. What’s changed is the scale and the sophistication of what gets loaded into these databases. Criminal groups now treat stolen-credential aggregation as its own product line, building searchable, indexed tools out of the same open-source software that large companies use to power internal search systems.
The irony is hard to miss. The infrastructure criminals use to organize stolen data is often less secure than the infrastructure their victims used to store it in the first place.
Lumma, Vidar, RedLine: The Malware Behind the Logs
Every record in this database started the same way: a piece of infostealer malware sitting quietly on someone’s computer, harvesting whatever the browser had saved.
The malware families most commonly linked to logs like these are Lumma Stealer, Vidar, RedLine, and Raccoon, plus a rotating cast of variants sold as malware-as-a-service on the same Telegram channels that distribute the stolen logs afterward. Vidar had a particularly strong run at the start of 2026, accounting for more than 73% of infected hosts tracked across the first two months of the year, according to industry telemetry cited by SecurityWeek. Lumma, meanwhile, kept operating through 2026 despite two separate law enforcement takedown efforts, a resilience that shows how cheap and disposable this malware infrastructure has become for the people running it.
These tools don’t need to trick a user into typing a password into a fake login page. They wait for a browser to autofill one, then quietly copy it, the saved session cookie, and whatever else sits in the browser’s storage, before sending it all to a remote server. Infection usually starts somewhere mundane: a cracked copy of a paid app, a fake game cheat, a browser extension that promised something it didn’t deliver.
From an Infected Laptop to a Supply-Chain Breach
The path from “employee downloads something they shouldn’t” to “company gets breached” isn’t hypothetical. Researchers have documented at least one case this year that traces the whole chain start to finish: an employee at AI startup Context.ai downloaded Roblox cheat software onto a work device and got infected with Lumma Stealer. The stolen credentials from that single infection were later connected to unauthorized access that contributed to breaches at Vercel and Mercor.
That’s the mechanism worth sitting with. A cheat tool built for a video game, a personal device blurred into a work one, and a stolen session cookie became the opening move in a multi-company incident. No phishing email. No brute-force attack. Just a browser that remembered a password it shouldn’t have needed to.
Why Credentials Paired With Login URLs Beat Old-Style Password Dumps
Old-school breach dumps forced attackers to guess. A leaked password list from one hacked forum told you nothing about where else that person used the same password, so criminals ran automated credential-stuffing attacks, firing stolen username-password pairs at hundreds of unrelated websites and hoping for a match.
Infostealer logs remove the guesswork. Each entry already comes tagged with the exact site the credential unlocks, because the malware captured it directly from a real login event. A stolen password isn’t just a password anymore. It’s a password plus a map.
Here’s roughly what one of these log entries looks like once malware has captured it, with the specifics scrubbed for this example:
[INFOSTEALER LOG ENTRY - ILLUSTRATIVE FORMAT]
URL: https://mail.example-corp.com/owa
USER: [email protected]
PASS: ********
---
URL: https://github.com/example-corp
USER: [email protected]
PASS: ********
---
URL: https://vpn.example-corp.com/portal
USER: [email protected]
PASS: ********Multiply that by 24 billion, and the practical difference between a credential leak and a targeted attack starts to disappear. An attacker doesn’t need to breach a company. They need to search a database for its domain name.
How the Leak Stacks Up Against History’s Biggest Breach Compilations
Raw record counts don’t tell the whole story. Data quality, duplication, and how fresh the credentials are all matter more than the headline number, but the count is still useful for scale. Here’s how the June 2026 database compares with the breach compilations that came before it.
| Breach Compilation | Year Found | Records | Data Size | Nature of Data |
|---|---|---|---|---|
| RockYou (original breach) | 2009 | 32 million | Not disclosed | Single-site plaintext passwords |
| COMB (Compilation of Many Breaches) | 2021 | 3.2 billion | Not disclosed | Aggregated breach dump |
| RockYou2024 | 2024 | ~9.95 billion unique passwords | Not disclosed | Password wordlist compilation |
| Mother of All Breaches (MOAB) | 2024 | 26 billion | 12 TB | Aggregated PII from thousands of past breaches |
| June 2026 Elasticsearch leak | 2026 | 24 billion | 8.3+ TB | Live infostealer logs from 36 sources, credentials paired with URLs |
By raw count, this database sits just behind MOAB and ahead of RockYou2024. What separates it from both is composition. MOAB and RockYou2024 were largely archival, built from years of recycled breach data. The June 2026 database skewed toward live infostealer output, credentials still tied to working login pages rather than passwords from sites that may have long since forced a reset.
Inside 2026’s Infostealer Economy, By the Numbers
The 24 billion credentials leaked from this single database sound almost abstract until they sit next to the rest of 2026’s numbers. Credential theft isn’t a side effect of cybercrime anymore. It’s the main event.
| Metric | Figure | Source |
|---|---|---|
| Records in the June 2026 exposed database | 24 billion | Cybernews |
| Size of the exposed database | 8.3+ TB | Cybernews |
| Distinct sources compiled into the database | 36 (30+ Telegram channels) | Cybernews |
| Credentials stolen by infostealers in 2025 | 1.8 billion across 5.8 million devices | Shattered.io |
| Compromised credentials circulating on criminal markets, 2025 | 2.86 billion | KELA State of Cybercrime 2026 |
| Share of infected hosts tied to Vidar, Jan-Feb 2026 | 73%+ | Industry telemetry, via SecurityWeek |
| MFA-bypass breaches attributed to session-token theft | 80% | Microsoft 2025 Digital Defense Report |
| Global information security spending, 2026 | $248.9 billion | Gartner, via Axis Intelligence |
Shattered.io’s research put 2025’s infostealer haul at 1.8 billion credentials across 5.8 million infected devices, an increase the firm described as an 800% surge over prior years. KELA’s State of Cybercrime 2026 report separately tracked 2.86 billion compromised credentials actively circulating on criminal markets in 2025 alone, drawn from malware logs, breach databases, and underground marketplaces combined. Microsoft’s own 2025 Digital Defense Report tied 80% of multi-factor-authentication bypasses to stolen session tokens rather than cracked passwords, a figure worth sitting with. MFA still blocks plenty of attacks, but a stolen session cookie can let an attacker skip the login prompt entirely.
A Second Warning Sign: Check Point’s VPN Zero-Day
The credential database wasn’t the only story reinforcing this point in June 2026. Days earlier, Check Point disclosed CVE-2026-50751, a critical authentication-bypass flaw in its VPN products carrying a CVSS score of 9.3. The bug let an unauthenticated attacker establish a full VPN session without a valid password, the result of a logic flaw in how the software validated certificates, as Help Net Security detailed shortly after disclosure.
Forensic evidence showed attackers had quietly used the flaw since May 7, 2026, more than a month before it became public. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on June 9 and gave federal civilian agencies until June 11 to patch or isolate affected systems, a three-day window under Binding Operational Directive 22-01. At least one confirmed case involved a Qilin ransomware affiliate using the flaw for post-compromise access.
Different bug, different vendor, same underlying failure. Authentication that’s supposed to keep unauthorized users out didn’t. Whether it’s a stolen password with a matching URL or a certificate-validation flaw that skips the password check altogether, the result for a defender looks the same: someone gets in who shouldn’t.
Market Impact: Passkeys, Identity Vendors, and Security Budgets
Global spending on information security is on track to hit $248.9 billion in 2026, according to Gartner figures compiled by Axis Intelligence. Identity and access management remains one of the fastest-growing categories within that budget. Two sub-categories in particular, consent management and subject rights automation, are expanding at 22.1% and 16.2% respectively, well ahead of the broader IAM market’s 11.8% growth rate.
None of that spending stopped a 24-billion-record database from sitting exposed for days. That gap between budget and outcome is exactly why passwordless authentication keeps gaining ground as a policy conversation rather than just a vendor pitch. Passkeys built on FIDO2 standards bind a credential to a specific device and domain, which makes them useless to an attacker even if they somehow end up in a database like this one. A stolen passkey doesn’t work anywhere else, unlike a stolen password.
Identity security vendors, credential-monitoring services, and companies selling breach-exposure checks are the more immediate beneficiaries. Enterprise security teams facing a leak of this size tend to reach first for whatever tool tells them fastest whether their own domain shows up in the data, then worry about longer-term architecture changes second.
Competitive Landscape: How Security Vendors Are Responding
Endpoint detection vendors have leaned hard into infostealer detection over the past year, since catching the malware before it phones home is the only reliable way to stop a credential from reaching a database like this one in the first place. Products from CrowdStrike, Microsoft Defender, and SentinelOne now ship with behavioral detections aimed at browser-credential-harvesting malware rather than relying solely on signature matching, which infostealer authors update too quickly for signatures to keep pace with anyway.
The leak also lands in a year already crowded with credential-driven incidents. One Medical’s breach, claimed by ShinyHunters, and a similar breach at Match Group both trace back to unauthorized access rather than a software exploit. So did the breach at Klue, which started with a single credential that had gone unrotated for four years. None of these are infostealer stories specifically, but they share the same root cause as the 24-billion-record database: credentials that should have been rotated, monitored, or replaced with something phishing-resistant, and weren’t.
That pattern is pushing identity vendors to market themselves less as password managers and more as full lifecycle platforms, tools that flag stale credentials, force rotation on a schedule, and detect when a login pattern looks like it’s coming from a stolen session rather than the real user.
What Security Teams and Individuals Should Do Now
For Enterprise Security Teams
Security teams don’t need to identify every one of the 24 billion records to act on this. A few steps matter more than a full audit: force password resets for any domain that shows exposure in breach-monitoring tools, invalidate active session tokens rather than just rotating passwords, since stolen cookies bypass password changes entirely, and prioritize phishing-resistant MFA or passkeys for anything internet-facing. Reviewing endpoint logs for infostealer indicators, unusual browser-data access, unexpected outbound connections to unfamiliar domains, matters too. Catching an infection early is cheaper than cleaning up after the credentials it stole end up in the next exposed database.
For Individual Users
Individuals have fewer moving parts to manage but the same basic playbook applies. Check whether an email address turns up in reputable breach-monitoring tools, change any reused passwords immediately, and turn on multi-factor authentication everywhere it’s offered. A password manager that generates unique credentials per site limits the damage of any single exposure to one account instead of dozens. None of this is glamorous advice. It’s also the difference between one compromised login and a cascade of them.
Predictions: Where the Infostealer Economy Goes From Here
A few things look likely for the rest of 2026, based on the pattern this leak fits into.
More exposed aggregation databases will surface. Criminal groups keep building searchable tools out of stolen logs, and the underlying software, Elasticsearch, MongoDB, and similar NoSQL platforms, keeps getting misconfigured at a predictable rate. Expect at least one more billion-record exposure before the year ends.
Passkey adoption accelerates faster among large enterprises than consumer apps. The economics favor companies with the engineering resources to roll out FIDO2 support, while smaller consumer platforms lag behind, creating an uneven security landscape across the accounts an average person holds.
Initial access brokers lean further into reselling logs instead of running their own intrusions. Buying a log with a working corporate VPN credential is cheaper and faster than developing an exploit, and this database previews how commoditized that supply chain has become.
Regulatory attention on exposed cloud databases grows. Lawmakers and regulators in the US and EU have already started asking pointed questions about breach notification timelines. A database this size, sitting exposed for days with no clear owner, is the kind of story that tends to surface in the next round of hearings.
Session-token theft overtakes password theft as the primary MFA-bypass method security teams track. That extends the trend Microsoft’s research already shows. Passwords matter less when a stolen cookie skips the login screen entirely.
Related Coverage
- Lumma Stealer Survives 2 Takedowns, Hits 394K PCs [2026]
- Passkeys vs Passwords vs 2FA: 93% Success Rate [2026]
- How to Set Up TOTP MFA: 12 Steps, 60 Min [2026]
- Klue Breach Hits 200 Firms via 4-Year-Old Credential [2026]
- One Medical Breach: ShinyHunters Claim 8.8TB Stolen [2026]
- CrowdStrike vs Defender vs SentinelOne: 100% MITRE [2026]
Frequently Asked Questions
What exactly did Cybernews find in June 2026?
An unsecured, publicly accessible Elasticsearch database containing 24 billion credential records: usernames, plaintext passwords, and login URLs, pulled together from 36 different sources of stolen data. It required no authentication to browse and was taken offline roughly three days after researchers found it, on June 15, 2026.
Is this the largest data breach in history?
Not by raw record count. The 2024 “Mother of All Breaches” held 26 billion records. But this database’s records came overwhelmingly from live infostealer malware logs paired with exact login URLs, which most security researchers consider more immediately dangerous than an older, archival compilation.
How much of the leaked data traces to active criminal channels rather than old dumps?
Roughly 1.7 billion of the 24 billion records trace to Telegram channels focused specifically on hacking and credential trading, including a 260-million-record cluster branded “Darkside.” The remaining 22.6 billion sat in a catch-all “collections” category with no single identifiable source, making the channel-attributed slice a smaller but more actionable target for threat-intelligence monitoring.
How can I check if my credentials were part of the leak?
Reputable breach-monitoring services let users search by email address to see whether their information appears in known exposed datasets. Cybernews and several security vendors updated their lookup tools shortly after the database was found.
What should I do if my information was exposed?
Change the password on any affected account right away, especially if you reused it elsewhere, and enable multi-factor authentication. If a service offers passkeys, switching to one removes the password, and the risk of it leaking again, entirely.
Does this mean my accounts were definitely hacked?
Not necessarily. Appearing in a stolen-credential database means the password was captured at some point, typically by infostealer malware on an infected device, not that every listed account has been actively broken into. It does mean the credential is available to anyone who finds or buys access to similar data.
Is multi-factor authentication still worth using if passwords are this exposed?
Yes, with a caveat. Traditional MFA blocks most password-only attacks. It’s less effective against session-token theft, the method Microsoft’s 2025 Digital Defense Report linked to 80% of MFA bypasses, since a stolen session cookie can let an attacker skip the login prompt entirely.
Who owned the exposed database?
Unknown. Cybernews said the server’s operator was never identified, which is typical for databases that appear to aggregate stolen data from multiple criminal sources rather than belonging to one legitimate organization.
How is this different from a typical company data breach?
A typical breach exposes one organization’s user data through a single point of failure. This database aggregated data from 36 separate sources across many unrelated victims and platforms, closer to a criminal inventory system than a breach in the traditional sense.
