24 Billion Credentials, 36 Sources, and 27 Records Actually Tagged "Redline"

On 12 June 2026, researchers at Cybernews found an unauthenticated Elasticsearch cluster sitting open on the internet: 8.3TB of data, roughly 24 billion records of usernames, plaintext passwords, and login URLs. It went dark three days later, on 15 June, before anyone outside the team that found it got a proper look inside. That short window is most of the reason this story is harder to pin down than the headlines suggest.

It’s also, on close reading, not really a “leak” in the sense most of the coverage implies. Nobody’s central database got hacked. What was sitting exposed was a warehouse — a compilation pulled together from 36 separate sources, mostly other people’s stolen data, aggregated by whoever built that Elasticsearch cluster and then, apparently, left it open to the internet.

What the 24 billion actually breaks down into

Cybernews published a source-by-source breakdown, and it’s worth sitting with before repeating the top-line number anywhere:

Source category	Records	Share of total
“Collections” — origin unidentified	22.6 billion	~94%
Various Telegram channels	1.7 billion	~7%
Telegram channels with “Darkside” in the name	260 million	~1%
Local database dumps	150 million	<1%
“Breach compilation combo”	146 million	<1%
Misc. (CVE IDs, news articles, social posts)	~17,000	~0%
Explicitly tagged “Redline stealer”	27	~0%

Two things stand out. First, the overwhelming majority of the number everyone is quoting — 22.6 of the 24 billion records — sits in a bucket the researchers themselves couldn’t identify the origin of. Second, of the 36 sources that make up the whole compilation, more than 30 trace back to Telegram, which is where infostealer logs get bought, sold, and given away by the gigabyte. The line item that made me actually read the underlying report twice was the last one: only 27 records, out of 24 billion, are explicitly tagged as coming from Redline, one of the most prolific infostealer families in circulation. Not because Redline wasn’t a major contributor — it almost certainly was, buried somewhere in that 22.6 billion “collections” bucket — but because the labelling in this dataset is close to nonexistent. Whoever built this database wasn’t running a research project. They were running a warehouse, and warehouses don’t bother labelling stock they’re not planning to audit.

A leak isn’t the right word for what this is

“Breach” implies a company got hacked and its user table walked out the door. That’s not what infostealer data is. Malware families like Redline, Lumma, and Vidar run on infected end-user machines — someone downloaded a cracked game, a fake browser update, a pirated tool — and quietly harvest whatever the browser has saved: usernames, passwords, session cookies, and, critically, the exact URL each credential belongs to. That data gets exfiltrated to the malware operator, then typically resold or given away on Telegram markets that specialise in “stealer logs.” A single infected machine can hand over credentials for dozens of unrelated services in one go, because that’s just what’s sitting in the browser’s saved-password store.

So a dataset like this one isn’t “Company X got breached.” It’s the accumulated output of years of individual malware infections across an unknown number of victims, scraped together by data brokers who specialise in aggregating exactly this kind of thing, sitting in one place because someone’s storage configuration was wrong. Cybernews compared it directly to 2024’s “Mother of All Breaches,” a 26-billion-record compilation with the same shape: not one incident, a pile of prior ones.

The one detail that’s actually worse than usual

Most of what makes this dataset “the biggest ever” is inflation from duplicates and recompilation — more on that below. But one structural detail in this particular dump is a genuine step up from a typical credential dump, and it’s the part worth taking seriously: every credential here is paired with the exact login URL it belongs to.

A raw username-and-password list is annoying but requires work — an attacker has to guess or discover where else that pair might be valid, which is the entire premise behind credential-stuffing tooling like the ones covered in Hydra vs. Medusa vs. Ncrack vs. Patator vs. Metasploit: point a tool at a login form and let it work through a list. A dataset that already knows the URL skips that step entirely. It’s not “here’s a password, go find out what it opens” — it’s “here’s the exact door this key was cut for.” That turns a pile of stolen credentials into a directly loadable target list for automated login attempts, no reconnaissance required. If there’s a reason this particular compilation earned “colossal” in every headline rather than being treated as one more recycled dump, that’s it.

Same story, one year apart, from the same outlet

Here’s the part that didn’t make most of the coverage: Cybernews ran this exact play in June 2025, almost exactly a year earlier, on a dataset of 16 billion records pulled from 30 exposed sets. The language from that report reads like a template for this one — not a single centralized breach, no reliable way to cross-check overlap between datasets, researcher Bob Diachenko stating plainly that “there was no centralized data breach at any of these companies.” Trade “30 datasets” for “36 sources” and “16 billion” for “24 billion,” and the two reports are describing the same phenomenon a year apart: the infostealer-log economy keeps growing, keeps getting recompiled by different brokers, and keeps getting rediscovered sitting in an unsecured database somewhere.

That’s not a reason to dismiss either story. A 50% year-over-year increase in the size of what’s circulating is a real data point about how much malware-harvested credential data is being traded, even accounting for duplication. It’s a reason to be precise about what grew: not “24 billion people got hacked this month,” but “the pile of previously-stolen credentials being aggregated and re-aggregated by data brokers is bigger than it was last year, and someone keeps leaving the warehouse door open.”

What’s actually unknown, in the researchers’ own words

Cybernews was upfront about the limits of a three-day investigation window: they couldn’t estimate how many duplicates the 24 billion records contain, couldn’t determine the age of most of the data, and couldn’t confirm who was operating the database. The 2025 report carried the identical caveat about duplicates. Neither team is claiming 24 billion or 16 billion unique, currently valid credentials — they’re reporting a raw record count from a compilation they got a brief look at before it disappeared. Reasonable people can and should still take the underlying risk seriously; reasonable people should also stop repeating “24 billion passwords leaked” as if it means 24 billion distinct compromised accounts, because nobody involved in finding this thing is claiming that.

What to actually do about it

None of the above changes the practical advice, because the practical advice doesn’t depend on knowing whether this is your first exposure or your fifth recompiled one:

Use a password manager and unique passwords per site, so a credential harvested from one infected machine or one stale breach can’t be replayed anywhere else it might match. Turn on MFA everywhere it’s offered, particularly on email, banking, and anything tied to account recovery for other services — it’s the single control that makes a matched username-and-password-and-URL triple stop being an automatic win. And if you want to check your own exposure properly rather than reacting to a headline, Part 5 of the Checking Your Own Public Footprint series covers a genuinely safe way to do that.

The headline number in a story like this is almost never the useful part. The useful part is always three layers down: what kind of data it actually is, how it actually got there, and what specifically changed about the threat as a result. Here, that’s infostealer malware quietly harvesting browser-saved credentials at industrial scale, a broker economy on Telegram trading and recompiling the results, and one structural change — URL pairing — that makes the eventual dump more directly weaponisable than the last one. The 24 billion is mostly noise. The URL pairing is the signal.