Misconfigured Firebase instances leaked 19 million plaintext passwords

Researchers scanning the public web found 916 misconfigured Firebase instances exposing approximately 223 million records (124.6M user-related), including ~19.9 million plaintext passwords, emails, phone numbers, and billing/bank details. The team automated discovery and sampling, notified affected site owners (842 emails), and observed limited remediation; the exposure is high-impact due to scale and the presence of plaintext credentials but arises from misconfiguration rather than a sophisticated exploit.