132K Records Stolen in Yahoo 0819 Stealer Log — Are You Affected?

HEROIC analysts identified this stealer log on May 20, 2023. The breach exposed 132,276 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as YAHOO NEW 0819, a Telegram-uploaded credential file targeting Yahoo-linked accounts.

Why This Is Dangerous

Every entry in this file contains a plaintext password that requires no cracking to use. Paired with a matching email address and the exact login URL, an attacker who downloads this file can log into any of the 132,276 listed accounts immediately. Yahoo email addresses are frequently used as account recovery contacts for banking, retail, and identity services, making them high-value targets for further account takeovers.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites each login was captured from

Why This Matters

At 132,276 records, this log gives attackers a large, ready-to-use list for credential stuffing, where automated tools test each email and password pair against banking, email, and retail sites in bulk. If any of the exposed passwords were reused on other accounts, those accounts are also at risk. The potential outcomes include account takeover, identity theft, and direct financial fraud across multiple platforms.

How This Stealer Log Works

YAHOO NEW 0819 was not built by hacking Yahoo's servers. Instead, infostealer malware infected individual users' devices, most often through pirated software, cracked applications, or malicious email attachments. Once installed, the malware silently copied saved passwords and autofill data from the victim's browser and transmitted everything to the attacker. Those stolen credentials were compiled into this log file and uploaded to Telegram, where it was freely distributed to anyone willing to download it.

Check If You Are Affected

HEROIC's free breach scanner searches 400 billion records. Search your email now. Free, takes seconds.