Exposed Elasticsearch Database Holds 24 Billion Credential Pairs

In June 2026, security researchers at Bright Defense discovered an exposed Elasticsearch database containing over 24 billion stolen credential records online. The data set includes usernames paired with passwords harvested across numerous websites over the years. ¹

The breach was identified when investigators noticed a publicly accessible Elasticsearch instance without authentication controls. Bright Defense’s team confirmed that the database was reachable via standard HTTP requests and contained billions of credential pairs in plain text. No specific organization was named as the owner of the server; however, the sheer volume suggests it aggregated data from multiple breached sites before being inadvertently left open to the world. ¹

Such misconfigurations are alarmingly common. According to NIST vulnerability reports earlier this year, more than half of all publicly exposed Elasticsearch clusters have weak or default credentials that allow unauthenticated access. When combined with the fact that many users reuse passwords across services, the risk posed by a dump of 24 billion entries is significant. Attackers can now harvest large swaths of valid logins for use in automated brute‑force campaigns against other platforms. ¹

Experts warn that databases like this underscore why multi‑factor authentication (MFA) should be mandatory wherever possible. Even if an attacker obtains a username/password pair, MFA adds a second layer—often something only the legitimate user possesses—that dramatically reduces the likelihood of successful compromise. The presence of such a massive credential pool also raises concerns about future phishing attacks: attackers may target victims whose login details were harvested from this dump, knowing they will likely still be active on other services. ¹

The incident highlights a broader trend in supply chain and configuration security. While the database itself was not tied to any single company, its exposure demonstrates how poorly secured infrastructure can become a global threat vector. Organizations must audit their Elasticsearch deployments regularly, enforce strong authentication mechanisms, and monitor for unauthorized public accessibility. Bright Defense’s findings serve as a reminder that even seemingly innocuous data stores can harbor catastrophic amounts of sensitive information when left unprotected. ¹

Overall, the 24 billion‑record Elasticsearch breach represents a scale of credential leakage that amplifies existing risks around password reuse, weak authentication practices, and misconfigured cloud resources. It serves both as a warning to organizations to secure their data stores rigorously and as a call to individuals to adopt stronger login habits—such as unique, complex passwords combined with MFA—to protect themselves from attackers who now possess a vast arsenal of stolen credentials.