13.7 million records were exposed in an unprotected database that contained a mash-up of credentials and sensitive personal data harvested from earlier breaches.
13.7 million records: what the exposed database contained
The repository discovered by cybersecurity researcher Jeremiah Fowler held roughly 13.7 million records and included a range of sensitive fields copied from prior incidents. According to the reporting, the dataset contained:
- Names
- Email addresses
- Phone numbers
- Passwords
- Bank account data
Those items were collected into a single, searchable store rather than remaining dispersed across the original breaches.
No encryption or password protection: how access was possible
Fowler found the database exposed with no encryption and no password protection, making its contents directly accessible. The company behind the platform had, the reporting states, “made them accessible to the public without authentication.” That configuration is the immediate technical failure that allowed the discovery.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleVibetech: the linked data intelligence platform
Fowler traced the database's IP address to a data intelligence platform associated with Vibetech. The report identifies Vibetech as an IT services and AI software development organization based in India. The linkage places responsibility for the exposed repository with an organization described in those terms in the reporting.
Previous breaches consolidated — AT&T breach and FBI employee directory among datasets
The exposed store was not composed solely of newly collected records. The company collected credentials from prior breaches and centralized them in the exposed database. Some of the breached datasets included were the AT&T breach and the FBI employee directory breach.
That centralization matters because older credentials can retain operational value. The report notes that historical breach data “can retain value for years, as malicious actors leverage historical breach data in order to identify victims.” By gathering disparate breach outputs into a single, easily explorable repository, the database increased the ease with which anyone — including cybercriminals — could search and reuse those records.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: The exposed configuration — no encryption, no password protection — highlights a concrete misconfiguration to audit for systems that aggregate third‑party breach data. Teams responsible for such platforms will be watching for similar open endpoints and for whether data-intelligence tools in their supply chain centralize old breach data without controls.
- Procurement leaders and affected enterprises: Organizations that buy or license data intelligence services will be attentive to how those vendors store consolidated breach material and whether contractual safeguards require encryption and access controls. The fact that Vibetech’s platform contained consolidated prior-breach credentials will sharpen procurement scrutiny of vendor data-handling practices.
- End users and the general public: The exposed records included personal contact fields, passwords and bank account data. Because the repository centralized information from known incidents — including the AT&T breach and the FBI employee directory breach — individuals impacted by earlier breaches face renewed exposure if the assembled records are accessed or reused.
At this time, the report is explicit that it is unclear whether the exposed database was accessed by malicious actors prior to Fowler’s discovery. That unresolved point is the central open question in a case whose concrete facts are otherwise straightforward: a large aggregation of previously breached material was assembled, hosted without encryption or authentication, and linked to a data intelligence platform associated with Vibetech.
The incident underscores a narrow but important dynamic: re-exposure can reanimate old breach data. When historical credentials are centralized and made searchable, their effective value to those seeking to identify or compromise accounts can increase, even if the original breaches are not recent. Whether any third parties exploited this particular exposure remains unresolved; the next steps in the record are whether the repository was accessed before its discovery and what remedial actions Vibetech and any customers of the platform undertake in response.
Original reporting: https://www.securitymagazine.com/articles/102600-14m-credentials-re-exposed-by-ai-development-company
