The IT Nerd

Cybersecurity researcher Jeremiah Fowler discovered a publicly accessible database containing 13.7 million credentials. The database appeared to be connected to Vibetech, an India-based AI software development and IT services company.

The exposed database contained:

• Personally identifiable information (PII) linked to individuals worldwide, including names, phone numbers, email addresses, passwords, and bank account details.
• Records that appeared to have been aggregated from previous security incidents.
• Data that could not be matched to known public breach disclosures, suggesting additional or previously unknown datasets.

You can read Jeremiah’s full findings on ExpressVPN’s blog here: https://www.expressvpn.com/research/vibetech-data-exposed

Recently, cybersecurity researcher Jeremiah Fowler discovered a database containing roughly 9,042,977 facial images totaling 450.2GB, in a research conducted in collaboration with ExpressVPN. The database, which appeared to be linked to ClarityCheck, a US-based reverse image search and identity verification service, was publicly accessible without password protection or encryption.

The exposed database contained:

• Facial images stored in folders labeled “faces” and “profiles,” including photos of adults, teens, and children.
• Profile pictures, screenshots, and personal photographs likely uploaded by users for searches or identity verification.

You can read Jeremiah’s full findings on the ExpressVPN blog here: https://www.expressvpn.com/blog/clarity-check-data-exposed/

Cybersecurity researcher Jeremiah Fowler recently discovered and reported to ExpressVPN about an unsecured database containing data belonging to Brazil’s Health Surveillance Information System, known as SISVISA.

The data exposed included, but was not limited to:

• Over 102,000 documents (~79GB of data), representing a significant and wide-scale security vulnerability.
• Sensitive PII, including names, CPF/CNPJ numbers, contact details, and physical addresses, with the potential to directly impact individuals’ privacy and safety.
• Regulatory and compliance records, including inspection reports, health surveillance documentation, permit applications, and backup files, heightening the risk of institutional and legal repercussions.

You can read the details here: https://www.expressvpn.com/blog/brazil-sisvisa-data-exposed/.

Cybersecurity researcher Jeremiah Fowler recently discovered and reported to ExpressVPN about multiple unsecured databases containing records linked to the Tribeca Film Festival. The exposed data included, but was not limited to:

• 666,369 total records across three unsecured databases labeled “development,” “staging,” and “production,” spanning records from 2019 to 2026.
• A production backup file with 295,916 records containing sensitive PII — email addresses, phone numbers, IP addresses, and hashed passwords — tied to users, film contacts, and more.
• Confidential documents, press kits, and marketing materials, some explicitly marked as confidential, potentially exposing A-list talent and industry professionals associated with the festival.

Jeremiah’s full findings and key takeaways are published on this blog: https://www.expressvpn.com/blog/tribeca-film-festival-data-exposed/