24 Billion Stolen Credentials Were Just Found in a Single Database. Here's What to Do in the Next 60 Minutes.

Breaking Research Credential Crisis

June 2026  ·  7 min read

On June 12, 2026, security researchers discovered a publicly accessible database containing 24 billion records — usernames, email addresses, plaintext passwords, and the login URLs they unlock. The database is now offline. The credentials are not. Here's what this means for your business and the five actions to take right now.

---

The first thing the researchers did when they saw the number was check it again. Then they checked it a third time. Twenty-four billion records. More than 8.3 terabytes of data, stored in a publicly accessible Elasticsearch cluster discovered on June 12, 2026. The database contained usernames, email addresses, plaintext passwords, and the specific login URLs that those credentials could be used to access.

The database was taken offline by June 15 — three days after discovery. But the credentials did not disappear when the database went offline. They had already been circulating across 36 sources — Telegram channels, breach compilations, infostealer malware collections, and what appeared to be direct exports from compromised live systems — for months or years before anyone found the database. Taking the database offline removes one copy from one location. The credentials remain active in every channel they came from.

24B

credential records in a single exposed database — discovered June 12, 2026

The vast majority are infostealer logs — usernames, passwords, and the specific services they unlock, harvested directly from infected devices. The database drew from 36 sources including cybercrime Telegram channels, historical breach compilations, and apparent live system exports. Researchers triple-checked the number. It held up.

22.6B records from "collections" — aggregated infostealer logs and previously leaked datasets combined into one searchable archive Cybernews / Security Affairs, June 2026

1.7B records from Telegram channels — cybercrime channels actively distributing stolen credentials, many still operational Cybernews / TechRepublic, June 2026

56.3M email addresses added to HaveIBeenPwned from this dataset on June 15, 2026 — check your domain right now TechTimes / HIBP, June 2026

What the database actually contained — and why it's different from a standard breach

Most data breaches steal credentials from one place. This database aggregated from 36 distinct sources across years of cybercrime activity. That distinction matters for understanding the risk.

Database composition — 24 billion records across 36 sources

Collections:22.6 billion records— aggregated infostealer logs, previously leaked datasets

Telegram channels:1.7 billion records— 30+ active cybercrime channels, English and Russian

Breach compilations:146 million records— historical breach data including AntiPublic dataset

Live system exports:~150 million records— apparent direct exports from compromised servers

CVE records:17,000 vulnerability IDs— cross-referenced with GitHub links for active exploit matching

Updated through:February 2026— database was actively maintained, not a static archive

The CVE vulnerability records are the detail that elevates this beyond a standard credential dump. Whoever assembled this database was cross-referencing stolen credentials against known software vulnerabilities — building a targeting system that matches which credentials unlock which services, then identifies which of those services have unpatched exploits. This isn't a credential dump for manual use. It's a credential-plus-exploit intelligence platform, maintained and updated through February 2026.

The database is offline. The risk is not. Every credential was pulled from active sources — infostealer malware still running on infected devices, Telegram channels still distributing stolen data, breach compilations still circulating among threat actors. Taking the database offline removes one search interface. The underlying data continues to flow through every channel it came from. The 56.3 million email addresses now on HaveIBeenPwned are searchable right now — for free.

The infostealer detail that changes your MFA calculation

The vast majority of the 24 billion records are infostealer logs — data collected by malware that silently harvests credentials from infected devices. This is where the story diverges from the standard "change your password" advice in a way that most coverage hasn't addressed.

Infostealers don't just steal passwords. They steal active browser session cookies. A session cookie is the token that proves you're already logged in — the credential that bypasses the login page entirely. If an infostealer captured your session cookie while you were logged into your work email or your company's cloud storage, the attacker already has an authenticated session. Changing your password after the fact doesn't invalidate the session cookie. The attacker's authenticated session may still be active.

This is why session hijacking — up 23% in SMB environments per the Guardz 2026 report — connects directly to this database. The 24 billion records aren't just credentials to use at the login page. A significant portion are session tokens that bypass the login page entirely. MFA doesn't stop a session token. A new password doesn't stop a session token. The only defense is forcing a complete re-authentication across all sessions — which requires knowing a session was compromised, which requires monitoring.

The five actions to take in the next 60 minutes

1

Run the HIBP domain search right now

Do this first

HaveIBeenPwned added 56.3 million email addresses from this dataset on June 15. Your employees' work emails may be in the results. A domain search shows every company email address that has appeared in known breach databases — including this one.

Right nowGo to haveibeenpwned.com → click "Domain Search" → enter your company domain → review results. Any email that appears has been in at least one breach. Every employee whose email appears should change their work password immediately and force a session sign-out across all devices.

2

Force sign-out across all active sessions — not just password resets

Session cookies at risk

Because infostealers capture session cookies, a password change alone doesn't close the window. An attacker with a stolen session token can continue accessing the account even after the password is changed. Force a complete sign-out of all active sessions — invalidating every session token — before issuing a new password.

For any affected accountMicrosoft 365: Admin center → Active users → select user → Sign out of all sessions. Google Workspace: Admin Console → Users → select user → Reset sign-in cookies. For other platforms: look for "Sign out of all devices" or "Revoke all sessions" in security settings. Do this before the password reset, not after.

3

Audit devices for infostealer malware before resetting passwords

Source of the problem

The 24 billion records are primarily infostealer logs — data harvested from infected devices. If an employee's credentials appear in this dataset, their device may still be infected. Changing the password on a compromised device means the new password is immediately captured by the same malware.

Before password resetsRun a full malware scan on any device belonging to an employee whose credentials appeared in breach results. Malwarebytes offers a free scan at malwarebytes.com. A clean device scan should precede any credential rotation — otherwise the new credentials are immediately at risk.

4

Enable number matching on MFA

Configuration · Free

Standard push notification MFA doesn't protect against session cookie theft — because session cookies bypass authentication entirely. But number matching significantly raises the barrier for the credential-stuffing attacks that use the password-based records in this dataset. Both defenses address different parts of the same problem.

If not yet configuredEntra ID admin center → Authentication methods → Microsoft Authenticator → Configure → enable number matching. Google Workspace Admin → Security → 2-Step Verification → enable number matching. Configure session timeouts: automatic sign-out after 8–12 hours of inactivity closes the session cookie window significantly.

5

Move from periodic to continuous credential monitoring

The systemic fix

The database was actively updated through February 2026. New credentials from new infostealers are added continuously to databases like this one. A one-time check today tells you where your employees stood on June 15. It doesn't tell you where they'll stand when the next dataset is compiled.

The permanent fixContinuous credential monitoring watches your domain against breach databases as new data appears — alerting you when an employee's work email surfaces in a new dump, before the credential is tested against your systems. Veriti Spottr does this automatically as part of the Exposure component of your CyberScore.

The scale of this database — 24 billion records from 36 sources, maintained and updated, cross-referenced with CVE vulnerability data — is the clearest single illustration of how industrialized the credential economy has become. This isn't opportunistic theft. It's infrastructure. A professional operation assembling and maintaining the world's largest login credential intelligence platform, updated monthly, cross-referenced with exploit databases, distributed across Telegram channels in English and Russian. The businesses that treat credential monitoring as a one-time annual check are treating an infrastructure problem as an event.

The honest context — what 24 billion means and what it doesn't

The 24 billion number includes duplicates — potentially significant duplicates. Researchers could not fully deduplicate the dataset before it was taken offline. The same credential appearing across multiple breach compilations counts multiple times. The real number of unique individuals affected is lower than 24 billion, though researchers have no way to quantify by how much.

What the number does represent accurately: the scale of credential aggregation happening in cybercrime ecosystems right now. This isn't a single breach. It's a window into how much stolen credential data is in active circulation — being bought, sold, tested, and used against real business systems every day. The 17 billion figure this series has cited since Post #2 just got updated. The economy that produced both numbers hasn't slowed down between them.

The five actions above take 60 minutes. The HIBP domain search takes 60 seconds. The credential monitoring that makes this a one-time response rather than a recurring scramble takes one setup. The response that works is the one that runs continuously — not the one triggered by the next headline.

The Veriti Spottr CyberScore's Exposure component monitors your domain against credential breach databases continuously — surfacing new exposures as they appear rather than waiting for the next 24-billion-record headline to prompt a check. The June 15 HIBP update added 56.3 million email addresses from this dataset. If your business has continuous monitoring, those additions triggered alerts the same day. If it doesn't, this post is the alert. Run the check now at haveibeenpwned.com — then consider whether one afternoon of setup is worth the continuous visibility.

📚 Credential Security Series — Read the full series

Part 1 → Your Password Policy Isn't Protecting You. Your Employees' Habits Are. Part 2 → Your Credentials Are Already For Sale. Here's How to Find Out in 60 Seconds. Part 3 → You Turned MFA On. Attackers Already Have Three Ways Around It. Part 4 → What Attackers Do With Your Data in the First 60 Minutes Part 5 → The 30-Minute Security Audit Every SMB Owner Should Do This Week Part 6 → The First 24 Hours After You Discover a Breach

Find out if your employees are in the 24 billion. Veriti Spottr's beta is free.

Get your CyberScore →

VS

Veriti Spottr Team AI-powered cyber risk clarity for SMBs  ·  veritispottr.com