Researcher Uncovers 96-GB Public Database Holding 149 M Stolen Credentials

This incident echoes past "credential dump" milestones such as 2019’s 773 M-record Collection #1 and the 2014 Yahoo mega-breach, but differs in that it exposed the criminals’ own aggregation hub rather than a victim company’s servers. It underscores two long arcs: the industrialisation of infostealer-as-a-service (cheap, automated, global) and the gradual obsolescence of the single password model in favour of hardware-bound passkeys and multifactor logins. On a century scale, the episode is a footnote—no new hack occurred—but it demonstrates how secondary crimeware markets now threaten state and personal security alike; leaking even the thieves’ stockpiles accelerates the push toward credential-less authentication much as 19th-century bank robberies spurred safe-manufacturing standards.