critical severity January 23, 2026 · 1 min read

149 Million Credential Mega-Exposure — January 2026

If you have an account with this organisation, here’s what’s now in circulation.

Security researchers discovered a publicly exposed 96 GB database with 149 million unique logins covering Gmail, Facebook, Instagram, Netflix, Binance, and government domains. The database had no password protection.

Pile of login-icon credentials with red warning tape and binary background

Security researchers discovered a publicly exposed 96 GB database containing 149 million unique logins, accessible without any authentication. The dataset spans personal services (Gmail, Facebook, Instagram, Netflix), financial platforms (Binance), and even government domain credentials. Infostealer malware likely fed this dump — the format and structure match known stealer-log compilations.

Already exposed?

You can’t unleak a breach. You can take away what it’s worth.

Deep Sweep shows you every leak tied to you and exactly what to change. Then it strips your name, address and family off the look-up sites that turn a leaked record into somebody knocking on your door — $29 one-time, includes 30 days of Protection. We write to 637 companies. No subscription to start.

Scan free, then Deep Sweep — $29 →

Not ready yet? Run a free breach check on this email

We’ll check it against 13.1B+ leaked records right now — no account needed. Continuous monitoring & alerts are part of Protection.

Gamers reusing credentials across Steam, Discord, Riot, Battle.net, and Epic are at immediate account-takeover risk. If any of those services share a password with one of the leaked entries, the attacker gets every account at once. This is the classic "combolist" fuel for doxxing chains — email + password = full persona mapping.

Why this is severe

Unlike a single-platform breach, infostealer compilations correlate credentials across dozens of services tied to the same person. An attacker doesn't just get into your Gmail — they get into your Gmail, Discord, Steam, Netflix, banking, and the metadata to chain it all to your real identity.

Recommended actions

What You Should Do

Run Warden on your primary email (no-subscription cleanup) to baseline your current exposure
Change every password reused across services (you should have a password manager)
Enable 2FA on every gaming, financial, and email account
Scan your devices for active infostealer malware (RedLine, Lumma, Vidar)
Enable Warden continuous monitoring so you find out when new breaches surface, with identity-chain mapping that connects new exposures to handles you already use

What the free scan actually returns

Sample resultyou@email.comIllustrative — not a real person

Found on people-search siteswe remove these

These listings are live, public, and legal to remove. That’s what a Deep Sweep buys.

value redacted in this sampleage, relatives, address historySpokeo

value redacted in this samplephone, household, property recordsBeenVerified

value redacted in this sample637 companies checked

Found in breach recordsverifiedreported — unverified

Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.

verifiedvalue redacted in this samplepassword + phone · 2024telecom breach

unverifiedvalue redacted in this sampleclaimed in ransomware listing · 2026leak-site claim

Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.

Check your exposure

This is one breach. Your email is probably in others.

~149 million unique logins accounts were exposed here. We can’t confirm any single incident against the sources we search, so we won’t pretend to — what we can show you is your own exposure: every leak and listing tied to your email, in about 15 seconds. No account, no card.

Report details & sourcing

Severity Critical

Disclosed January 23, 2026

Last reviewed July 22, 2026

Affected ~149 million unique logins

Data exposed Email addressesPlaintext passwordsService domains (Gmail, Facebook, Instagram, Netflix, Binance)Government domain credentials

By GalaxyWarden Threat Research · Editorial & sourcing standards

Editorial & sourcing policy

GalaxyWarden is a breach-monitoring service and news aggregator. We do not exfiltrate, host, purchase, or redistribute stolen data. Breach information is compiled from publicly accessible sources and threat-intelligence platforms, and is reported as claims attributed to their source. We promptly correct or remove material shown to be inaccurate — see our content & takedown policy or write to support@galaxywarden.com.

Sources: ACI Learning analysis · TechRepublic (Jan 2026)

Related breaches

high January 23, 2026