Security researcher Jeremiah Fowler has found an unsecured repository holding 13.7 million records of credentials, bank details and personal data that appears to compile information from previously reported breaches and leaks. The database was linked to Vibetech, an India-based AI software and IT services firm.
What Fowler Found in the Exposed Repository
The 13.7 million records included credentials, bank details and personal data. Their apparent sources include breaches tied to AT&T, Amazon, Walmart, PayPal, the FBI, Interpol and others. The data appears to be a compilation of earlier breaches and leaks and not a fresh theft from any one of those organizations.
A Belgian Database With IBANs and a Kuwaiti University Database
The repository referenced a Belgian database containing personal data and International Bank Account Numbers, and a Kuwaiti university database. Those references show the compilation extended beyond large US brands to regional and institutional data sources.
Records That Did Not Match Known Breach Counts
Some of the records matched known breach counts, and others did not. The mismatches may indicate previously unknown breaches, according to the report, though the report does not confirm that. The distinction matters: a record that matches a public breach adds no new exposure, while one that does not match could represent an unreported incident.
Vibetech and the IP Address Link
The database was tied to an IP address associated with a data intelligence platform operated or developed by Vibetech, an India-based AI software and IT services firm. The report does not specify the connection between Vibetech and the data. The link rests on the IP address, so the company’s role could be as a platform operator, a developer or something else, and the available reporting does not settle which.
There is no company statement in the source. Vibetech has not been reported as confirming ownership of the database or explaining why it held the records.
Disclosure and Restricted Access
Fowler sent a responsible disclosure notice and notified the hosting provider. The database was then restricted. The report was published on October 13 after the disclosure.
Unknowns: Duration of Exposure and Third-Party Access
The duration of the exposure and whether threat actors accessed the repository are both unknown. The data was open to anyone who found it before access was restricted, but no source reports that anyone besides Fowler downloaded it.
Why an Aggregate of Old Credentials Carries Risk
A searchable aggregate of old credentials enables credential stuffing, phishing and social engineering. Combining records from many separate breaches into one place changes the risk calculation. A single old breach exposes data tied to one service, while a compiled database lets someone look up a person across many breaches at once, matching a leaked password from one service against accounts on another.
Bank details and IBANs add a financial dimension that credential-only leaks lack. Records that pair identity data with account numbers support targeted fraud attempts more convincingly than an email and password alone.
Vibetech’s Data Intelligence Platform and the Unanswered Purpose of the Collection
The source describes the linked platform as a data intelligence platform from an AI software and IT services company. The presence of what appears to be compiled breach data on infrastructure associated with such a platform raises questions about the purpose of the collection, which the reporting leaves unanswered. The report does not say whether the data was gathered for a commercial product, for research or for another use.
The case is the latest example of third-party aggregations of leaked data surfacing outside the organizations whose customers were affected. The companies named as record sources are not reported to have been breached again as part of this finding, and the report cites no statements from them.
