The file was unencrypted. No password protection. No security. Just a plain text file with millions of sensitive pieces of data.

The database’s exposure duration is unknown. Signs of infostealer malware were found, but no confirmed breach or misuse of user data, says cybersecurity researcher.

A cybersecurity researcher has uncovered a massive trove of compromised login credentials, raising new alarms about the scope and scale of InfoStealer malware campaigns. The exposed Elasticsearch database contained more than 184 million unique usernames and passwords.