Vulnerabilities · Privacy
Vibetech Database Leak Exposes 13.7 Million Records with Sensitive Data
A misconfigured Vibetech database exposed 13.7 million records, including passwords and bank details from previous breaches. The exposure included data linked to AT&T and the FBI.
Ross GrantUpdated 2 min read
The short version
A database belonging to Vibetech was left open on the internet, exposing 13.7 million records with sensitive details like passwords and bank accounts. The data included information from earlier breaches involving well-known organisations. A security researcher found and reported the issue, and the database was quickly secured. It is not clear if anyone else accessed the information while it was exposed.
By the numbers
- 13.7 millionrecords exposed in the Vibetech databaseHackread
- 2,241,617records in 'Gambling Private Combo' collectionHackread
- 24,021records in 'BluBank Digital Bank Leak' collectionHackread
What happened?
A database linked to Vibetech, an AI software and IT services company, was found exposed online without authentication. The database contained 13.7 million records, including sensitive data from previous breaches involving AT&T and the FBI. A researcher reported the issue, and the database was secured soon after. It is unclear how long the data was exposed or if it was accessed by others.
What was exposed
According to Hackread (opens in a new tab), a database linked to Vibetech, an AI software and IT services company based in India, was left accessible online without any password or authentication. The database contained 13.7 million records, including names, phone numbers, email addresses, plaintext passwords, and bank account details. Some of the data referenced previous breaches involving organisations such as AT&T, Casio, and the FBI. Specific collections included the "BluBank Digital Bank Leak" (24,021 records) and the "Gambling Private Combo" (2,241,617 records).
How the exposure was found and fixed
Cybersecurity researcher Jeremiah Fowler discovered the open database. He traced the server’s IP address to a data intelligence platform operated or developed by Vibetech. This platform appeared to aggregate data from earlier breaches and leaks. Fowler reported the issue to Vibetech and the hosting provider. The database was quickly restricted from public access. The next day, the same IP address showed an ISMS (Information Security Management System) compliance dashboard instead of the exposed data.
Who could be affected
The exposed records included sensitive information such as plaintext passwords and bank details. If accessed by criminals, this data could be used for account takeovers, identity theft, or financial fraud. The presence of phone numbers and bank details could also help attackers create convincing scams. Since the data included information from previous breaches, people whose details were already leaked elsewhere could be at further risk.
What Vibetech and others have said
There is no public statement from Vibetech about the incident. The only reporting so far comes from Hackread, based on Fowler’s findings. It is not clear how long the database was exposed or whether anyone else accessed it before it was secured. Hackread notes that similar exposures have led to phishing attacks and account takeovers in the past.
What you should do
If you think your information may have been included in previous breaches, consider changing your passwords, especially if you reuse them across accounts. Use unique, strong passwords for each service and enable multi-factor authentication where possible. Watch out for phishing attempts or scams using your personal details. Regularly check your accounts for suspicious activity and review your credit reports for signs of fraud.
Uncertainties
This incident has only been reported by one outlet and has not been confirmed by Vibetech or any government agency. Details such as the length of exposure and whether the data was accessed by criminals are unknown.
Claimed vs confirmed
- Unconfirmed
13.7 million records, including AT&T and FBI data, were exposed in a Vibetech database.
Reported by Hackread based on research by Jeremiah Fowler. Not confirmed by Vibetech or authorities.
The impact
- Money
- If regulators find Vibetech responsible for exposing personal data, fines could reach up to €20 million or 4% of annual global turnover under EU GDPR, or similar amounts under other data protection laws.
- Reputation
- The exposure of sensitive data, especially from high-profile breaches, can damage Vibetech’s reputation and erode trust with clients and partners.
- Customers
- Anyone whose data was included in the exposed records could face phishing, fraud, or identity theft. People should change reused passwords and monitor accounts for suspicious activity.
Why it matters
Millions of people’s personal and financial details could be at risk if criminals accessed the exposed database. Even if the data came from earlier breaches, its collection in one place increases the risk of further attacks, fraud, or identity theft. The incident highlights the dangers of misconfigured databases and the ongoing risks from previously leaked data.
How does it work?
The exposure happened because the database was left online without any password or security authentication. This allowed anyone with the correct URL or IP address to access the sensitive information it contained.
Key points
- A Vibetech database with 13.7 million records was exposed online without protection.
- The data included sensitive details from previous breaches, such as passwords and bank accounts.
- A researcher discovered and reported the issue, and the database was quickly secured.
- It is not clear how long the data was exposed or if anyone accessed it.
- Misconfigured databases continue to be a major risk for organisations.
Sources
Hackread
Reference
