24 billion credentials exposed: Inside the record infostealer leak
Jun 20, 2026
8 min read
Share:
On June 12, 2026, the Cybernews research team discovered a publicly accessible Elasticsearch cluster holding more than 24 billion credential records across 8.3 terabytes of data, one of the largest exposed collections of stolen login data ever recorded. The database had no password, no authentication, and no network restrictions: anyone who located its address online could read it in full. It was taken offline on June 15, but the credentials it contained had already been copied and remain in active circulation among criminals.
What sets this leak apart from previous "mega-breaches" is not only its size but its composition. The overwhelming majority of the 24 billion records are infostealer logs, freshly harvested credentials paired with the exact login URLs they unlock. Aggregated from at least 36 separate sources, the database represents the industrial consolidation of the credential-theft economy into a single, searchable index that enables automated account takeover at planetary scale.
What happened
The exposed data was a curated aggregation, not a single breach. Cybernews traced the 24 billion records to 36 distinct sources. The single largest tranche, roughly 22.6 billion records, came from unlabelled "collections", repackaged compilations whose original breaches are difficult to trace. More than 1.7 billion records were pulled from over 30 cybercrime-focused Telegram channels, most in English and some in Russian, where stolen credentials are traded daily. Around 146 million records came from known breach-compilation "combolists", and roughly 150 million were exported directly from live, compromised target servers.
Crucially, the operator was still curating the dataset when it was found. Researchers noted that the cluster contained a cybersecurity news article dated February 2026, evidence that whoever assembled it was actively monitoring the threat landscape and topping up the collection with fresh stolen data right up to the point of discovery. This was not a static archive; it was a living, maintained credential warehouse.
What was exposed
Because most records are infostealer logs, the exposure goes well beyond a username-and-password pair. Malware of this class harvests everything a browser and operating system will surrender. The dataset and the logs feeding it typically include:
Plaintext credentials mapped to their target URLs
Email addresses, usernames, and passwords stored in raw, unencrypted form, each paired with the precise website or service it unlocks. Attackers do not have to guess where a password works; the data tells them exactly which door each key opens.
Session cookies and authentication tokens
Infostealers capture active session cookies and tokens, including those that can bypass multi-factor authentication by replaying an already-authenticated session. This lets an attacker skip the login screen and the second factor entirely.
Autofill data and device fingerprints
Saved form data, browser autofill entries, and device fingerprints that help attackers impersonate a victim's device and slip past fraud-detection and anomalous-login systems.
Corporate and infrastructure access
Mixed among consumer accounts are credentials for corporate email, cloud consoles, VPN portals, and SaaS platforms, harvested from infected employee and contractor machines. These are the exact keys that ransomware crews and initial-access brokers pay for.
The presence of live-server exports and fresh infostealer output, as opposed to years-old breach data, is what makes this collection an active operational risk rather than background noise.
How attacks like this unfold
The pipeline begins with an infection. A user downloads a cracked application, a fake software update, a game cheat, or a malicious browser extension, or is tricked by a "ClickFix" prompt into pasting a script into their terminal. Infostealer malware such as Lumma Stealer, RedLine, or Raccoon then silently vacuums saved passwords, cookies, and autofill data from every browser on the machine and ships it to a command-and-control server.
From there the logs enter the criminal supply chain. They are sold and traded through Telegram channels and dark-web marketplaces, bundled into "collections", and eventually aggregated into searchable databases like the one Cybernews found. Because each credential is tagged with its target URL, an attacker can run automated credential-stuffing campaigns against thousands of services at once, prioritising high-value targets: corporate email, cloud administration panels, banking, and VPN gateways.
The final stage is account takeover. Where victims reused passwords or lack phishing-resistant authentication, a single stolen login can cascade into full account compromise and, for corporate credentials, into network intrusion. The infostealer-to-enterprise pathway has become the dominant initial-access vector of 2026: a low-cost consumer malware infection on one laptop routinely becomes the entry point for a six-figure ransomware event weeks later.
Why leaders should care
This leak does not represent a breach of any single organisation, which is precisely what makes it dangerous. A company can have flawless perimeter security and still have employee, contractor, or customer credentials sitting inside this database, harvested from a personal device it does not manage. The traditional boundary between "our systems" and "the internet" does not contain infostealer risk.
The scale removes any illusion of obscurity. With 24 billion records indexed and mapped to their destinations, a meaningful fraction of every password in active use is now in attacker hands, ready for automated testing. Any account protected only by a password, no matter how strong, must be treated as exposed. Regulatory obligations under GDPR, PCI-DSS, and sector-specific frameworks attach the moment stolen credentials lead to unauthorised access to personal or payment data, and "the credentials came from an employee's home computer" is not a defence regulators accept.
For security leaders, the operational question is no longer whether credentials have leaked, but whether the organisation can detect and survive their use. That means validating that MFA is enforced everywhere it matters, that credential-stuffing and anomalous-login detection actually fire, and that a single compromised password cannot be walked into a domain-wide compromise.
What to do now
Move critical accounts to phishing-resistant authentication
Deploy passkeys and FIDO2 security keys for email, cloud consoles, VPNs, and administrative accounts. Unlike passwords and one-time codes, these credentials are cryptographically bound to the legitimate site and cannot be phished, replayed, or harvested by infostealers. They are the one authentication model this economy cannot defeat.
Enforce MFA everywhere and eliminate password reuse
Require multi-factor authentication on every account, prioritising anything that shares a password with another service. Mandate a password manager so each login has a unique, long, random credential, and reset any password known or suspected to be reused across systems.
Hunt for infostealer infections on endpoints
Because the root cause is malware on devices, deploy and monitor endpoint detection and response to identify infostealer activity, and restrict the installation of unauthorised software, browser extensions, and cracked applications. Treat any device that touched corporate credentials and shows infection indicators as compromised until proven otherwise.
Monitor for exposed credentials continuously
Subscribe to credential- and dark-web-monitoring services so leaked corporate logins are flagged as they surface, not months later. Early detection of a stolen credential is often the only chance to break the attack chain before it reaches production systems.
Validate your defences against real attack paths
Engage a penetration testing team to simulate credential-stuffing and account-takeover attacks and confirm that MFA, session handling, and detection controls hold under pressure. Pair it with a security code review of authentication and session-management logic to close the gaps, weak session invalidation, missing token binding, absent rate limiting, that turn a single stolen credential into a full compromise.
Pressing questions
Was my password in this leak?
There is no way to browse the database directly, but given its size and the fact that most records are recent infostealer logs, you should assume any password you have reused or entered on an infected device is exposed. Check your email addresses against reputable breach-notification services, and treat a match as a prompt to rotate that credential everywhere it was used.
Does multi-factor authentication protect me?
MFA dramatically reduces the risk of a stolen password alone leading to takeover and remains essential. However, infostealer logs often include session cookies that can bypass MFA by replaying an already-authenticated session. Phishing-resistant methods, passkeys and FIDO2 keys, close that gap; SMS and app-based one-time codes do not fully.
We are a business, not an individual. How does this affect us?
Corporate credentials are mixed throughout these logs, harvested from employee and contractor devices that your controls may never touch. A single infected personal laptop with a saved VPN or single sign-on password can hand an attacker the keys to your environment. Assume some corporate credentials are exposed and design controls that survive that assumption.
The database is offline now. Is the risk over?
No. Cybernews secured the exposed instance on June 15, 2026, but the credentials were copied and remain in active circulation across Telegram channels and marketplaces. Taking one server offline does nothing to invalidate the passwords themselves; only rotating credentials and adopting phishing-resistant authentication does.
Key takeaways
The 24-billion-record leak is less a single incident than a snapshot of a matured criminal economy. Infostealer malware harvests credentials at industrial scale, the logs are aggregated and mapped to their targets, and the result is a searchable index that turns account takeover into a push-button, automated operation. Its size, comparable to the 2024 "Mother of All Breaches" but dominated by fresh, live-stolen data, means password-only security can no longer be considered adequate for anything that matters.
The defensive response is clear even if the leak's full contents never will be. Assume exposure, move high-value accounts to passkeys and phishing-resistant MFA, eliminate password reuse, hunt for infostealer infections on the endpoints that feed these databases, and validate through testing, not assumption, that a stolen credential cannot be walked into a breach. In an era where a meaningful share of every password is already in attacker hands, resilience comes from architecture, not from hoping your credentials stayed secret.