Badly configured Firebase databases exposed 19 million passwords.

In 2024 three researchers scanned more than five million websites and found 916 whose Firebase databases had missing or wrong security rules. Together they exposed about 125 million user records with names, emails and bank details, and around 19 million passwords stored as plain text. Only about a quarter of the owners fixed the problem after being told.

Why this happens: Databases like Firebase need rules that say who may read what. Without them, anyone can read every record. Passwords should never be stored as plain text; a proper login service stores them in a form nobody can read back.