This "dream wish list for criminals" includes millions of Gmail, Facebook, banking logins, and more. The researcher who discovered it suspects they were collected using infostealing malware. A database containing 149 million account usernames and passwords--including 48 million for Gmail, 17 million for Facebook, and 420,000 for the cryptocurrency platform Binance --has been removed after a researcher reported the exposure to the hosting provider. The longtime security analyst who discovered the database, Jeremiah Fowler, could not find indications of who owned or operated it, so he worked to notify the host, which took down the trove because it violated a terms of service agreement. In addition to email and social media logins for a number of platforms, Fowler also observed credentials for government systems from multiple countries as well as consumer banking and credit card logins and media streaming platforms.

Security expert Bob Diachenko, along with Comparitech, has discovered more than 267 million Facebook user IDs, phone numbers and names in an unsecured database. The huge trove of data is likely the result of an illegal scraping operation or Facebook API abuse by a group of hackers in Vietnam. The exposed data could be used by threat actors to conduct large-scale SMS spam and phishing campaigns. "A database containing more than 267 million Facebook user IDs, phone numbers, and names was left exposed on the web for anyone to access without a password or any other authentication." "Comparitech partnered with security researcher Bob Diachenko to uncover the Elasticsearch cluster.

Evernote's new privacy policy is turning heads -- and users away. The note-taking app quietly announced earlier this week its intentions to update its privacy policy, which will let some of its employees access and read user content as part of the company's effort to improve the service. The company said in its proposed privacy policy, which determines what it does with its users data, including their notes, that the changes are "primarily to make sure that our machine learning technologies are working correctly." Evernote's machine learning technologies are thought to include artificial intelligence hooks, such as searching with natural language queries. The policy added that the few employees who will have access to user data will be "subject to background checks and receive specific security and privacy training at least annually."