Loading story…
E-commerce marketplace Storenvy was reportedly breached, exposing about 1.5 million user accounts in a leak that included credentials stored in plain text. Reports said the compromised data contained usernames, email addresses, IP addresses, and passwords, sharply increasing the risk of account takeover, credential stuffing, and follow-on compromise for users who reused the same passwords on other services.
The incident stood out because the leaked passwords were allegedly not hashed, reflecting weak credential protection practices at the time of the breach. Users affected by the exposure were urged to reset their Storenvy passwords immediately, change any reused passwords on other platforms, and enable stronger account protections where available, while defenders were advised to watch for phishing and suspicious login activity tied to the leaked records.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
404 Media reported unauthorized changes to Ukraine frontline maps and said the edits appeared to point toward Polymarket's war-betting activity. The reference indicates disclosure of the suspected manipulation but provides no earlier specific date than publication.
NBC News reported that the compromise of Microsoft's email system was becoming more severe, indicating a significant escalation or newly understood impact in the incident. The reference does not provide a more specific event date than the publication date.
E-commerce firm Storenvy was reported hacked, with about 1.5 million user accounts exposed. The leaked data reportedly included plaintext account credentials, making this the key disclosed event in the reference.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
nbcnews.com
Open source404media.co
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and media reports disclosed enormous troves of exposed login data, including an unprotected 47.42 GB database containing **184,162,718** unique usernames and passwords tied to services such as Microsoft, Facebook, Google, Instagram, Snapchat, Discord, Netflix, PayPal, and government portals in 29 countries. Security researcher Jeremiah Fowler found the database on an unmanaged server with no password protection or encryption, and sample records included account types, website URLs, and plaintext passwords labeled `senha`. Fowler said multiple individuals confirmed the leaked credentials were genuine after he contacted them directly. The exposed records are believed to be linked to **infostealer malware** and broader malware-as-a-service collection operations, with subsequent reporting describing a far larger cache totaling **16 billion** credentials affecting major consumer platforms including Apple, Facebook, and Google. The disclosures raise immediate risks of credential stuffing, account takeover, phishing, fraud, and unauthorized access to corporate and government systems. Public access to the 184 million-record database was later restricted after responsible disclosure to the hosting provider, but the owner of the data remains unidentified.
Jun 29, 2026
A leaked dataset posted on an illicit forum exposed live Stripe API keys and related payment data from hundreds of merchants, with reports citing **659 to 669 vendor accounts**, **1,033 confirmed keys** in the initial release, and claims that the broader cache could contain up to **20,000 to 50,000 Stripe secrets**. Researchers said the material included customer records, invoices, transaction metadata, hosted invoice links, promotional codes, partial payment card details, and roughly **33 GB to 35 GB** of associated data, creating risks of fraud, privacy violations, unauthorized refunds, payment rerouting, and revenue loss. Investigations indicate **Stripe itself was not breached**; instead, the exposed credentials appear to have been harvested from merchants’ public code repositories, unmasked GitHub Actions logs, misconfigured web servers, exposed environment files, or debug logs. Analysts verified that some sampled keys were still active and could be used to list customer data, create fraudulent payment links, modify webhooks, and even process test charges, while some merchants reportedly rotated keys without revoking old ones. Recommended response measures include auditing version-control history, revoking and rotating exposed keys, replacing broad secrets with restricted Stripe keys, and enabling Stripe fraud-detection controls such as Radar rules.
Aug 21, 2026
Researchers uncovered an exposed **Elasticsearch** database containing roughly **24 billion** plaintext credential records, including usernames, email addresses, passwords, and associated login URLs. The dataset was estimated at more than **8 terabytes** and appeared to aggregate data from **36 sources**, including infostealer logs, Telegram channels, prior breach collections, local database dumps, and exports from live servers. Investigators said the database was publicly accessible before being taken offline, but the owner could not be identified. The exposed records create a significant risk of **credential stuffing**, account takeover, and broader identity abuse at global scale, especially for users who do not use **multi-factor authentication**. Researchers reported that more than 30 of the sources were linked to Telegram channels and that **22.6 billion** entries were broadly labeled as “collections,” while signs of regular updates suggested the dataset was being actively curated. They also found records referencing **CVE** identifiers, GitHub links, breach news, and social media posts about incidents, indicating the operator may have been monitoring the cybersecurity landscape while maintaining the credential trove.
Jul 12, 2026