24 Billion Stolen Credentials Found Exposed in an 8.3 TB Elasticsearch Cluster Dominated by Infostealer Logs
Cybernews researchers found an unsecured Elasticsearch cluster holding 24 billion records compiled from 36 sources, mostly infostealer logs with plaintext passwords.
Editor's Note ·
- Correction:
- The article attributes to Malwarebytes the statement that the earlier 'mother of all breaches' held 26 billion records. The cited Malwarebytes article uses the phrase 'mother of all breaches' but does not give a 26-billion figure (it identifies that earlier dump's source as Leak-Lookup without a record count). The 26-billion figure comes from the cited Cybernews source, which describes its own 2024 'supermassive leak' of over 26 billion records as the only comparable prior discovery. The comparison itself is accurate; only the source attribution was incorrect.
Overview
Security researchers have found an unsecured database holding 24 billion stolen records exposed to the open internet, one of the largest such troves ever discovered. According to SC Media, the Elasticsearch cluster contained usernames, passwords, and login URLs in plaintext, compiled from 36 different sources. The find was made by researchers from Cybernews, who reported the discovery.
The collection weighed in at 8.3 TB, according to Malwarebytes, which described it as an Elasticsearch cluster assembled from 36 sources. The database was discovered on June 12, 2026, and secured on June 15, 2026, according to Israel Defense.
What We Know
The overwhelming bulk of the records are infostealer logs — data harvested by malware from infected devices. Per Israel Defense, the dataset contained stolen login credentials harvested from infected devices, including usernames, email addresses, plaintext passwords, and login URLs, with malware families that included the RedLine stealer.
Infostealer logs typically capture far more than just a username and password. According to Malwarebytes, such logs can include passwords stored across all browsers, active session cookies and tokens — including those that bypass multi-factor authentication — autofill data, device fingerprints, and sometimes crypto wallets or messaging accounts.
The 36 sources were a mix of channels and compilations. SC Media reported that the data was drawn from Telegram channels, previous data breach collections, and data exported from live servers, and that around 260 million records were linked to Telegram channels associated with the defunct ransomware group Darkside. Roughly 1.7 billion records came from hacking-related Telegram channels in both English and Russian, according to Malwarebytes. The largest single category, about 22.6 billion records, came from unidentified “collections,” per Israel Defense.
The scale puts the find in rare company. Malwarebytes noted that a previous incident dubbed the “mother of all breaches” held 26 billion records, and that this exposure is in the same league as that earlier mega-dump but appears more heavily weighted toward fresh infostealer logs.
The primary danger is account takeover at scale. SC Media reported that the volume poses a significant risk of account takeovers for billions of users, especially those without multi-factor authentication.
What We Don’t Know
The owner of the database has not been identified. According to SC Media, the operator remains unidentified, with the data showing a mix of English and Russian origins, and the database appeared to be regularly updated, suggesting active monitoring of the cybersecurity landscape. Beyond the credential dumps, the cluster also held CVE records, GitHub links, news articles on recent breaches, and even social media posts discussing cyber incidents, according to Israel Defense — artifacts more typical of a research operation than a criminal stash.
That ambiguity extends to intent. Israel Defense reported that researchers suspect the database may be linked to a threat intelligence or breach-monitoring operation, with the exposure caused by a misconfiguration during migration. It is not publicly clear how long the cluster was reachable before it was found, or whether anyone other than the researchers accessed it.
Analysis
The exposure underscores how infostealer malware has reshaped the credential-theft economy. Rather than relying on a single corporate breach, criminals now aggregate logs siphoned from millions of individually infected machines — the same pattern seen in recent supply-chain malware such as IronWorm, a Rust-based npm infostealer that self-propagates through stolen credentials. Because infostealer logs frequently include session tokens that can bypass multi-factor authentication, a fresh log can be more valuable to an attacker than a leaked password alone.
For individuals, the practical response is the same regardless of who owned the database. Malwarebytes advised users to check their exposure status, change any compromised passwords immediately, avoid reusing passwords across accounts, and enable multi-factor authentication wherever it is available.