Jeremiah Fowler and outlets such as WIRED documented an internet-exposed warehouse of roughly 149 million username-password pairs with login URLs, characterized as infostealer aggregation rather than a single service hack. BreachHistory files it under unattributed MOAB-style compilation indexing.
Canonical record: Open database 149M credentials 2026 on BreachHistory.
Sources: WIRED, ExpressVPN blog