149M Passwords Leaked: Gmail, Netflix & More

A substantial cache of login credentials—spanning over 149 million unique usernames and passwords—was recently discovered in a publicly accessible cloud database. The credentials, which reportedly amount to 96 GB of raw data, include accounts from popular dating apps, social media platforms, banking sites, and even government domains.

While the origins of the breach remain uncertain, experts caution that the exposed information highlights ongoing threats associated with credential-stealing malware.

A password leak occurs when login credentials become exposed through a breach, malware, phishing, insecure storage, or another compromise.

The biggest danger often comes from password reuse.

One leaked password can create access to multiple accounts if the victim used it everywhere.

How it happened

This data breach did not result from a single company hack or technical malfunction. Instead, cybersecurity researchers found a cloud database filled with stolen credentials, likely harvested over time by malicious actors using infostealing malware.

These programs infect computers and mobile devices—often through risky downloads, phishing emails, or software vulnerabilities—then silently collect usernames, passwords, and other private information as people log into their accounts.

Once harvested, this data was stored in a cloud repository accessible to anyone who found it on the dark web. The database lacked basic security protections and had no information about its owner. Despite being reported to the hosting provider, it took nearly a month and multiple attempts before the exposed data was finally removed.

During that window, the number of available records continued to grow, suggesting ongoing collection or aggregation from infected devices worldwide.

What information was exposed

• Email addresses and usernames

• Passwords (for a wide range of platforms)

• Login URLs for associated accounts

• In some cases, credit card or banking login data

• Government (.gov) and educational (.edu) account credentials

• Social media accounts (Facebook, Instagram, TikTok, and others)

• Entertainment and financial service accounts (Netflix, OnlyFans, trading accounts, cryptocurrency wallets)

• Estimated scale: 149 million unique logins, including

  • Gmail (48M)

  • Facebook (17M)

  • Instagram (6.5M)

  • and more

How do password leaks happen?

If you're asking how do password leaks happen, consider a compromised shopping website.

Suppose attackers obtain a database containing email addresses and passwords.

If those passwords were stored insecurely, criminals may be able to recover them.

They then try the same email-and-password combinations on major services.

This is called credential stuffing.

The attacker does not need to hack every service individually. They take credentials stolen from one place and test them somewhere else.

How do you check whether a password was leaked?

A reputable password leak check or leaked password check can tell you whether selected credentials appear in known breach data.

Be cautious with websites claiming to provide a leaked password database or password leaks database that ask you to type your current password.

You should never have to give a stranger your live password in order to determine whether an old password was compromised.

What should you do if your password was leaked?

If your password leaked or you discover a password has appeared in a data leak, change it immediately if it is still in use.

Then check for reuse.

For example, if “Summer2023!” was used for your old shopping account, email, streaming service, and social media, all four should receive new unique passwords.

Your email account deserves special attention because it often controls password resets for other services.

Does a Gmail address in a leak mean Google was breached?

Searches for Google passwords leaked or Google password leak can be misleading.

A database containing Gmail addresses does not necessarily mean Google's systems were compromised.

For example, a person may use a Gmail address as the username for a completely unrelated website. If that site is breached, the Gmail address appears in the leaked data even though Google itself was not the source.

Always look for the origin of the credentials before assuming which company was breached.

Why this matters

The exposure of such a vast and varied set of login credentials matters for anyone who relies on online services for communication, entertainment, finance, or work. When credentials are leaked at this scale, individuals and families could face risks such as identity theft, financial fraud, unauthorized access to sensitive platforms, and tailored phishing attacks.

Even government-linked accounts from multiple countries were among those compromised, raising concerns about public sector impersonation or broader impacts on security. For everyday users, this means that attackers may attempt to use stolen credentials to access not only primary accounts but also connected services, increasing the potential for personal or financial harm.

What to do now

• Reset passwords for any affected accounts, especially those using the same credentials across multiple platforms.

• Use unique, strong passwords for each account and consider a password manager.

• Enable multi-factor authentication wherever possible.

• Monitor financial statements and account activity for signs of unauthorized access.

• Be wary of phishing emails or unexpected login notifications.

• If you have government or educational accounts, alert your institution’s IT/security team.

• For financial or banking accounts, consider contacting your bank and monitoring for suspicious activity.

• If you suspect your personal photos or images may be affected, perform a reverse image search to see if they appear elsewhere.

• Report identity theft to the FTC at ReportFraud.ftc.gov

Stay secure with OmniWatch

OmniWatch helps protect your online identity with continuous monitoring and real-time alerts if your credentials appear in known data leaks. Our platform empowers you to respond quickly to threats and reduce your risk of identity fraud.

---

This guide is published by OmniWatch. Follow OmniWatch on Facebook for ongoing guidance on identity protection, digital safety, and scam awareness.

Sources

Security Magazine, 149M Credentials Exposed — Facebook, Instagram, Government and More Included