Jeremiah Fowler (ExpressVPN Research, October 12, 2026) found an unencrypted, unauthenticated database of 13.7 million records that already looked like old breach and combo lists: names, emails, phones, passwords, and some bank-account fields. Cybernews corroborated on October 13–14. MERENA listed the same title on October 14 and included it as an Advisory in the October 16 weekly wrap.
This is not a report that AT&T, Amazon, PayPal, Walmart, the FBI, or Interpol were hacked this week. The labels on the files pointed at prior leaks. Re-exposing them in one searchable pile still feeds credential stuffing, phishing, and business email compromise. Fowler says he notified the company and the host; the database was then restricted. How long it sat open, and whether anyone else copied it, is unknown.
We scanned ic3.gov, cybernews.com, merena.com, expressvpn.com, and vibetech.in. 100% is the ideal overall domain-security score. None reach it. vibetech.in is last at 29%, with Identity 0%.
Snapshot
| Field | Detail |
|---|---|
| Researcher | Fowler / ExpressVPN · Oct 12, 2026 |
| Coverage | Cybernews · Oct 13–14 |
| Consumer lead | MERENA alerts · Oct 14 listing · Advisory in the Oct 16 wrap |
| Linked host | India-based Vibetech AI/IT platform on a .in domain (vibetech.in) |
| Status | Database restricted after disclosure; exposure window unknown |
| Report | ic3.gov if money or BEC followed a reused password |
Fowler is explicit: many firms use the name Vibetech. The IP and dashboard he saw tied to a .in site that advertises AI tools, prompts, and personalized matching — not other companies that share the name. He does not allege criminal collection. He does say organizations that hoard breached credentials still have to protect that pile.
What was in the pile
Fowler’s public write-up named the largest labeled sets. Treat the names as file labels, not proof of a new incident at those brands. We are not publishing emails, passwords, or dumps.
| Labeled set (Fowler) | Records |
|---|---|
| AT&T data leak | 7,910,431 |
| Gambling combo | 2,241,617 |
| casio.ru breach | 1,714,752 |
| Amazon combo | 1,210,905 |
Smaller labeled sets in the same repository included a Walmart combo, a PayPal combo, and government-directory names. Some totals matched known public incidents; others did not. Fowler says those may be mixed lists or previously unpublished leaks. Either way, a password from 2021 still works if it was reused.
Why old passwords still pay
Centralizing millions of records lowers the work for anyone who would otherwise buy scraps on forums. Typical follow-on:
- Credential stuffing — try the same email and password on mail, banks, shops, and payroll.
- Phishing — a known email, phone, or bank snippet makes a fake “reset” or “invoice” look personal.
- BEC — Fowler cites IC3’s $2.77 billion in 2024 BEC losses. Criminals often need the mailbox, not the shopping password.
Change reused passwords. Use a password manager. Turn on a second factor that is not SMS. Report fraud at ic3.gov.
MFA on the accounts stuffing hunts
Hardware keys and authenticator apps raise the cost after you lock the real account. They do not unsay an old combo list.
| Grade | Meaning |
|---|---|
| Fail | SMS, email OTP, or no public key / open TOTP |
| Pass | Self-serve Google Authenticator-style open TOTP |
| Strong | FIDO2 / YubiKey-class security key for sign-in |
| Platform | Grade | YubiKey | Authenticator |
|---|---|---|---|
| Amazon shopping | Fail | No | Yes |
| PayPal | Fail | No | Yes |
| AT&T myAT&T | Fail | No | No |
| Walmart shopping | Fail | No | No |
| ExpressVPN | Fail | No | No |
| MERENA | Fail | No | No |
| Vibetech | Fail | No | No |
Amazon’s two-step help names text or authenticator app, plus passkeys. No retail YubiKey button. SMS keeps the row Fail.
PayPal 2-step help names Google Authenticator. PayPal MFA help still sends OTP by SMS, WhatsApp, phone, or email, and promotes passkeys. New 2-step enrollments are app-based; hardware keys are not the public path. SMS/email OTP keeps Fail.
AT&T verification is a code by text, email, phone, or mail. Connected Life documents Google Authenticator — that is a different product. myAT&T stays Fail.
Walmart.com shopping documents SMS phone verification. Seller Center names Google Authenticator and SMS/email — still Fail if you use that portal. No public shopping YubiKey.
ExpressVPN account security (May 16, 2026) verifies sign-in with email codes. ExpressKeys can store TOTP for other sites. The VPN login itself has no public YubiKey or Google Authenticator path.
MERENA signs in with email and password (or phone). No public YubiKey or open TOTP. vibetech.in has no public MFA docs (the homepage also failed with HTTP 500 during this review).
Directory: MFA support directory · Business Apps, Consumer Finance, and Email & Identity.
Recommended MFA tools
| Product | Best for | Get it |
|---|---|---|
| YubiKey 5C NFC | USB-C laptops + NFC phones | Amazon |
| YubiKey 5 NFC | USB-A desktops + NFC phones | Amazon |
| Proton Pass | Passkeys + authenticator-style TOTP | Proton Pass |
We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.
Independent cybersecurity audits
We audited the report, wrap, coverage, and linked company hosts on October 16, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not mean a retailer was newly breached, and they are not a grade of Fowler’s research.
| Organization | Domain | Overall | vs 100% |
|---|---|---|---|
| FBI IC3 | ic3.gov | 87% | −13 |
| Cybernews | cybernews.com | 59% | −41 |
| MERENA | merena.com | 54% | −46 |
| ExpressVPN | expressvpn.com | 44% | −56 |
| Vibetech | vibetech.in | 29% | −71 |
| Domain | Identity | Transport | Website |
|---|---|---|---|
| ic3.gov | 90% | 45% | 97% |
| cybernews.com | 65% | 15% | 40% |
| merena.com | 50% | 15% | 45% |
| expressvpn.com | 25% | 15% | 43% |
| vibetech.in | 0% | 15% | 40% |
Audit links: ic3.gov · cybernews.com · merena.com · expressvpn.com · vibetech.in
vibetech.in is the weak row: Identity 0%, email infrastructure 30%, and no MX on the blacklist probe. A spoofed “we secured your data” note is easier to send as that brand than the overall 29% suggests. Type vibetech.in yourself — and remember Fowler’s warning that other Vibetech names are different companies.
Brand hosts whose old combo labels appeared (same-day audits; not new-breach scores):
| Domain | Overall | vs 100% |
|---|---|---|
| walmart.com | 75% | −25 |
| att.com | 60% | −40 |
| paypal.com | 57% | −43 |
Audit links: walmart.com · att.com · paypal.com
att.com, walmart.com, cybernews.com, merena.com, and expressvpn.com sit at 15% transport (MTA-STS / related). A lookalike reset mail is easier to deliver than those overall scores suggest.
Website stack
Passive homepage + Certificate Transparency probes (October 16, 2026). Versions only — not a claim the sites were compromised.
| Domain | Stack note |
|---|---|
| ic3.gov | CMS undetected; DigiCert TLS expires 2027-01-05 |
| expressvpn.com | CMS undetected; Amazon Trust TLS expires 2027-02-27 |
| cybernews.com | CMS undetected; Google Trust TLS expires 2027-01-14 |
| merena.com | Next.js (X-Powered-By); Let’s Encrypt TLS expires 2026-12-14 |
| vibetech.in | CMS undetected; Let’s Encrypt TLS expires 2026-12-03; HTTP→HTTPS redirect not confirmed |
| att.com | CMS undetected; DigiCert TLS expires 2027-04-23 |
vibetech.in returning HTTP 500 on a fetch during this review matches a host that is not in a tidy production state. That is a probe observation, not a second dump.
Blacklist and lookalikes
Email blacklist checks (public DoH, October 16, 2026): ic3.gov, expressvpn.com, cybernews.com, merena.com, and att.com were clear on mail/domain lists we can query. vibetech.in had no MX and no web IPs on that check (no_ips) — reputation is empty, not “clean and well-hosted.”
Registered lookalikes that matter if stuffing turns into mail (BEC / standard squat scan):
| Lookalike | Technique | Signal |
|---|---|---|
| ic3.com | TLD swap | BEC staging (NS + MX) |
| att.biz | TLD swap | BEC staging (NS + MX) |
| natt.com | insertion | BEC staging (NS + MX) |
| exepressvpn.com | insertion | NS + A + MX |
| amerena.com | insertion | NS + A + MX |
AT&T also owns defensive CNAMEs (att.co, att.info, att.us). vibetech.com and other TLD swaps are registered because the name is common — Fowler says they are not this company. Type ic3.gov, att.com, expressvpn.com, merena.com, and vibetech.in — not a near-spell from a “your password leaked” mail. Continuous monitoring: Cybersquat Domain Monitoring.
CourtListener RECAP searches for Vibetech India, vibetech.in, and this October 2026 exposure did not turn up a matching U.S. docket. This remains a researcher-disclosure story, not a filed federal case we can cite.
Related coverage
- Chick-fil-A One credential stuffing
- Houston brushing / QR-package phishing
- Gmail recovery-contact injection
- MFA support directory
Sources: ExpressVPN Research — Fowler, Oct 12, 2026 · Cybernews, Oct 13–14, 2026 · MERENA alerts listing (Oct 14 title; Advisory in the Oct 16 wrap) · Amazon two-step · PayPal 2-step and MFA · AT&T verification codes · ExpressVPN account security · MERENA devices / sign-in. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 16, 2026. Domain scores: audit.emailmenow.com only.