Vibetech Database Exposed 13.7M Breached Credentials

An unprotected database linked to Vibetech, an India-based AI software development and IT services company, exposed 13.7 million breached credential records to anyone with a web browser, cybersecurity researcher Jeremiah Fowler said in a report published by ExpressVPN on 12 October 2026. The records included names, phone numbers, email addresses, plaintext passwords, and bank account details belonging to people in multiple countries. The database had no password protection or encryption.

The data was not stolen in a new attack. According to Fowler, the server belonged to a data intelligence platform operated or developed by Vibetech. The platform collected credential datasets from prior breaches and leaks and made them publicly available without authentication.

Fowler said some of the data matched breaches previously disclosed. Other sets did not match the record counts in any known public disclosure, which he said may indicate combined datasets or breaches that were never reported.

The platform labelled each dataset by its origin. The largest, marked “AT&T Data Leak,” held 7,910,431 records, nearly 58% of the 13.7 million total. Next came a “Gambling Private Combo” of 2,241,617 records, a “casio.ru Data Breach” of 1,714,752 and an “Amazon Private Combo” of 1,210,905. A combo is a list of email-and-password pairs, often compiled from several leaks and used to test logins on other services.

Smaller sets included a Walmart combo of 420,368 records and a Spanish WhatsApp database of 98,325. There was also a BluBank digital bank leak of 24,021 records, a PayPal leak of 18,157 records, and a Belgian file of 6,601 records containing IBAN bank details. The thirteen named datasets total about 13.67 million records, nearly the entire collection.

Three sets carry the most sensitive labels: an “FBI Employee Directory” of 4,084 records, an “Interpol Data Leak” of 929 records, and a student directory of 71 records. These names are the platform’s own labels. Fowler’s report does not confirm that any of them came from the organisation named.

Screenshots in the report show how little effort it took to access. One record, labelled as part of the AT&T set, stores an att.net email address next to a readable password. Each record also carries a source tag of “admin_ingest”, a “breach_directory” category, an import timestamp of 15 April 2026 and the original email:password line exactly as it was imported. A second screenshot shows the raw index answering a wildcard _search?q=* request on port 9600. That is an Elasticsearch-style query that asks the server to return everything, and it ran directly in the browser address bar.

The same IP address hosted a threat-intelligence dashboard over unencrypted HTTP. The dashboard claimed 4.14 billion total breached records, 99.2 million added in the month, and 7.9 million added that week. It listed Gmail, Yahoo, Hotmail and Outlook as the most common domains.

An “Intelligence Insights” panel said that email credentials accounted for 72.1% of all records and identified RedLine as the primary source. RedLine is an infostealer malware that harvests passwords saved in browsers, and the panel estimated 5,193,979 infections. These figures cover the platform’s wider collection, not only the 13.7 million records Fowler found exposed, and no one has independently verified them.

Fowler said he sent a responsible disclosure notice to Vibetech and alerted the hosting provider, after which the database was restricted. The next day, the IP address showed an Information Security Management System (ISMS) compliance dashboard in place of the plaintext credentials.

An ISMS is a framework organisations use to manage and protect sensitive data. A platform built to track leaked data had itself leaked data, and a security management dashboard replaced it within a day.

Several companies use the Vibetech name. Fowler said this server was tied to a .in domain and is unrelated to the others. The company’s website describes an AI platform offering tools, prompts and personalised matching. Fowler said the breach platform may have been an internal project or something built as a contractor for a third-party client.

He said it is unknown how the company obtained the credentials. He stated that he does not allege wrongdoing by Vibetech and does not claim the data was exploited as a result of this exposure. Fowler’s report does not include a response from Vibetech.

Old breach data still causes harm when it is re-exposed. Fowler said the danger comes from “centralizing millions of records in a single searchable repository.” Data that once required searching several underground forums is now available through a single interface. Known email addresses feed phishing and business email compromise (BEC) scams, in which criminals impersonate executives or suppliers to redirect payments. The FBI’s Internet Crime Complaint Centre reported BEC losses of $2.77 billion in 2024.

The exposure also raises questions under Indian law. Fowler pointed to the Digital Personal Data Protection (DPDP) Act and the IT Act, 2000. He noted that regulators may treat re-exposure of aggregated breach data as a separate breach, with its own notification duties. He made no claim about how either law applies to Vibetech.

Anyone who has appeared in a past breach should change any passwords they have reused across services and enable multi-factor authentication wherever it is offered. Treat unsolicited messages that mention past purchases or employers with suspicion, since breached email addresses keep their value to scammers long after the original password changes.

Several questions remain open. It is unknown how long the database was public, whether anyone other than Fowler accessed it, and where the unmatched datasets came from. It is also unknown whether Vibetech will notify the people whose records it holds.