109,862 Passwords Leaked in Logs_23 July Telegram Breach

In July 2026, HEROIC analysts identified a large stealer log file named "Logs_23 July" shared on a Telegram channel. The file contains 109,862 records, each pairing an email address with a plaintext password and the login URL the credential was captured from.

Why the Logs_23 July Leak Is Dangerous

With nearly 110,000 records, this is one of the larger stealer log dumps HEROIC has tracked recently. The data did not come from a hacked company database. It was pulled directly off infected computers by information-stealing malware, which silently copies saved browser passwords and sends them back to whoever operates it. Because each record already matches a specific website with a working email and password, an attacker can log straight into that account with no guessing required.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs (the exact site each credential unlocks)

Why This Matters

Because the passwords in this file are plaintext and already tied to their websites, they are immediately usable for credential stuffing and account takeover on a large scale. With over 100,000 records involved, this leak carries a meaningfully higher risk of identity theft and financial fraud than a smaller dump, especially for anyone who reuses passwords across multiple sites.

How a Stealer Log This Large Gets Built

Stealer logs come from malware infections, not database breaches. Victims are infected through cracked software, phishing emails, or fake downloads, and the malware then quietly harvests every saved username, password, cookie, and autofill entry from the browser. A dump this size typically represents data pulled from thousands of separate infected devices, all combined into one file and shared or sold on Telegram channels and dark web forums.

Check If You Are Affected

With 109,862 credential pairs now circulating, checking your exposure is worth the minute it takes. HEROIC's free breach scanner searches more than 400 billion leaked records, including stealer logs like this one, so you can quickly find out if your email or passwords have been exposed and lock down your accounts before someone else uses them.