Massive breach exposes 149 million Instagram, Gmail, OnlyFans passwords: How to stay safe?

A massive cybersecurity incident has been uncovered where 149 million unique login and passwords were exposed. However, this was not part of some nefarious plan by a hacker but a cybersecurity researchers found 149,404,754 unique logins and passwords, totaling around 96 GB of raw credential data, was left completely open without password protection or encryption, making it accessible to anyone who knew where to look.

The leak was uncovered by cybersecurity researcher Jeremiah Fowler who shared his findings via ExpressVPN. Among the affected

Which apps were affected in the data leak?

Fowler found that the exposed records included usernames and passwords had data spanning across almost every major online service imaginable. Among the affected services included social media platforms like Facebook, Instagram, Tiktok and X (formerly Twitter), dating sites and OnlyFans accounts.

The leak also exposed a large number of streaming and entertainment accounts, including Netflix, HBOmax, DisneyPlus, and Roblox, along with financial services accounts, crypto wallets, banking logins, and even credentials associated with government (.gov) domains.

Here's a complete list of everything that was affected:

Email Accounts: Fowler predicts around 48 million Gmail accounts, 4 million Yahoo accounts, and 1.5 million Outlook accounts were found in the leak

Social Media: The database contained logins for 17 million Facebook accounts, 6.5 million Instagram accounts, 780k TikTok accounts, and numerous X credentials.

Entertainment:Around 3.4 million Netflix account credentials were exposed in the leak. Other entertainment services hit include HBO Max, Disney+, and Roblox. However, the researcher didn't share an exact data on the numer of accounts compromised

Financial & Gov: The leak included around 420k Binance accounts, banking logins, and even government credentials (.gov domains) from multiple countries

How was the data leaked?

Fowler says that the database appeared to have created by ‘infostealer’ malware which is a type of malicious software that is designed to silently infect devices and harvest credentials.

“When data is collected, stolen, or harvested it must be stored somewhere and a cloud based repository is usually the best solution. This discovery also shows that even cybercriminals are not immune to data breaches” Fowler noted in his report

Is the stolen data still online?

Fowler said that he had reported the databse to the hosting provider but it took them a month before the hosting was suspended and millions of stolen credentials were no longer accessible. He says the hosting provider would not disclose any additional information regarding who managed the database and it is not even certain if the information was gathered for legitimate research purposes or for criminal activity.

During the month long period that the hosting wasn't suspended, Fowler sayd that the numer of records actually increased which suggests that the malware was feeding new stolen data into the repository

What can you do to stay protected?

Fowler says simply changing your passwords might not be enough to protect you from infostealer malware. He says if your device is infected with malware, any new password you type will also be captured.

He suggests a few ways to protect yourself online:

1) Scan for Malware First

Fowler says that malware spreads through malicious email attachments, fake software updates, compromised browser extensions, and even deceptive advertisements.

He suggests taking a few immediate actions if you suspect your device to be affected by Malware.

Fowler says using a password manager can reduce some of the basic risks posed by infostealer malware and keyloggers. They can encrypt the user data and prevent simple keyloggers from capturing typed passwords.

3) Two-factor authentication:

The researchers advices enabling two-factor authentication or biometric protections to add an additional verification step for preventing unauthorized access of accounts by criminals using compromised passwords

4) Don't reuse passwords:

Fowler says that passwords should not be reused across different sites, apps or services.