Massive 16TB Database Exposing 4.3 Billion Professional Records Discovered Unsecured On November 23, 2025, security researcher Bob Diachenko and nexos.ai uncovered an unsecured 16TB MongoDB database containing approximately 4.3 billion professional records. The database, which remained exposed until it was secured two days later after researchers alerted the owner, posed significant risks for large-scale cyberattacks. The dataset included nine collections, with three—profiles, unique_profiles, and people—holding nearly two billion records of personally identifiable information (PII). Exposed data encompassed names, emails, phone numbers, LinkedIn profiles, job roles, work history, education, skills, and social media links. The unique_profiles collection alone contained over 732 million records, many with image URLs, while the people collection included enrichment metrics tied to the Apollo.io ecosystem, though no breach of Apollo was confirmed. Timestamps indicated some records were collected or updated in 2025, though portions of the data may have originated from older LinkedIn breaches, including those claimed by threat actors in 2021. The database’s ownership remains unconfirmed, though clues suggest a lead-generation firm, which advertises access to over 700 million professionals—a figure closely matching the unique_profiles count. The company took the database offline a day after being notified, but researchers stopped short of direct attribution, noting the data may have been scraped from multiple sources. The leak’s scale and structure make it a prime resource for cybercriminals. With billions of records, attackers can automate highly targeted phishing, CEO fraud, and corporate espionage campaigns. Large language models (LLMs) could further exploit the data to generate personalized scams at scale, reducing the effort required to compromise high-value targets, such as Fortune 500 employees. Additionally, the dataset could be enriched with other leaked information, enabling credential-stuffing attacks and more sophisticated social engineering schemes. The incident underscores the growing threat of AI-driven cybercrime fueled by unsecured, mass-collected data.