That data was likely harvested by criminals, said researcher Bob Diachenko, an independent security consultant in Kyiv.

The database, which Diachenko discovered with a search engine, was freely accessible online for at least 10 days beginning Dec. 4, he said. He notified the internet provider where it was hosted when he found it on Dec. 14; five days later it was no longer available.

Diachenko said someone downloaded the database to a hacker forum two days before he discovered it so it may have been shared among online thieves.

He first reported the finding Thursday in partnership with the U.K. tech news website Comparitech, which editor Paul Bischoff said has been helping write up Diachenko's discoveries of unsecured databases for about a year.