AI company linked to exposed database of 13.7 million breached records

Exposed credential repository

Cybersecurity researcher Jeremiah Fowler found an unsecured database containing 13.7 million records tied to earlier breaches and leaks. The records referenced Amazon, Walmart, AT&T, PayPal, the FBI and Interpol, and included email addresses, usernames, passwords, phone numbers and bank account details.

The repository was connected to an IP address associated with a data intelligence platform operated or developed by Vibetech, an AI software development and IT services company in India. Vibetech describes its platform as AI powered and built to help users develop artificial intelligence skills through tools, prompts and personalized matching.

The largest referenced collections included 7.9 million records from an AT&T data leak, 2.24 million from Gambling Private Combo, 1.71 million from the Casio.ru breach, 1.21 million from Amazon Private Combo and 420,368 from Walmart Private Combo. Other collections included Spain WhatsApp with 98,325 records, BluBank with 24,021, PayPal Private Combo with 18,157, an FBI employee directory with 4,084 and Interpol with 929. Fowler also noted references to a Belgian database with personal information and IBANs, and a database tied to a university in Kuwait.

Why old leaks still matter

Fowler said some records matched previously disclosed incidents, while others did not match known public counts, which may indicate material from previously unknown breaches. He sent a responsible disclosure notice to the company connected to the IP address and notified the hosting provider. The database was later restricted and was no longer publicly accessible. How long it was exposed and whether attackers accessed it first remain unknown.

The report warned that old credentials can stay valuable because attackers can reuse them in credential stuffing attacks against other services. A searchable database can also be more convenient for criminals than data scattered across underground forums. Exposed contact and banking details can support social engineering and phishing messages that appear convincing.

Risks and safety steps

The report does not specify the connection between Vibetech services and the exposed credential repository. Companies collect compromised credentials for threat intelligence, security research and monitoring for compromised accounts, but Fowler said such work sits in a legally and ethically complex environment. Aggregating sensitive data creates another repository that must be secured, and weak access controls can extend the harm of the original breaches.

Fowler recommended changing passwords for affected accounts and any account sharing the same credentials, using a different strong password for every service, ideally with a reputable password manager, and enabling multi-factor authentication wherever possible. He urged caution with unexpected emails, texts or calls that reference personal details from the leak, and said requests for sensitive information or money transfers should be verified through an official contact channel rather than links or contact details supplied in the message.

Sources: Cybernews