Dark Web Intel: 99,849 USA Facebook Credentials Are Now Public

HEROIC analysts identified this Stealer log on 05-Jun-2025. The breach exposed 99,849 records, with stolen data including Email Addresses, Plaintext Passwords, and URLs. The source is identified as 100K USA Facebook, uploaded by a Telegram User.

Why This Is Dangerous

This stealer log specifically targets Facebook accounts belonging to US users and contains nearly 100,000 plaintext email and password pairs. Facebook accounts often contain personal photos, private messages, and connections to banking apps or marketplace transactions. An attacker who gains access to a Facebook account can impersonate the owner, scam contacts, or access linked applications.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

With nearly 100,000 Facebook credentials exposed, this breach provides attackers with a large pool of US accounts to target. Beyond direct account access, these email and password combinations are routinely tested against other services like banking, email, and shopping platforms in credential stuffing attacks. People who use the same password for Facebook and other services are at the highest risk.

How Stealer Logs Work

Stealer logs are created by malware that runs silently on infected devices. As users visit websites and enter their login credentials, the malware captures that information along with the web address. The resulting data is assembled into files and shared through private Telegram channels, where cybercriminals buy, sell, and trade stolen credentials.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to find out if your credentials appear in this breach or others. The scan is free and takes seconds.