The 144 USA FA PP Leak: A Small but Real Password Exposure

HEROIC analysts identified a small stealer log dataset labeled "144 usa fa pp," uploaded to a Telegram channel on June 18, 2025. The file contains 144 records made up of email addresses, plaintext passwords, and the URLs of the sites those credentials were used on. It's a small batch compared to some of the larger logs HEROIC tracks, but every record still represents a real person's exposed login.

Why This Is Dangerous

Small size doesn't mean small risk. This data comes straight from an infected device, so each password is plaintext and already matched to the exact email address and website it belongs to. For the 144 people in this file, that means an attacker can attempt to log directly into their accounts without any guesswork, cracking, or delay.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

Because the passwords are plaintext and tied to specific login pages, this leak enables immediate account takeover for anyone affected. If any of these 144 people reused their password on other accounts, such as email, banking, or social media, attackers can attempt credential stuffing to see where else the same login works, turning one small leak into a bigger problem for the individuals involved.

How Stealer Logs Work

Stealer logs are produced by infostealer malware that infects a device through channels like phishing links, pirated software, or fake downloads. Once active, it silently extracts saved browser passwords, autofill entries, and active sessions, then compiles them into a log file. Small, targeted batches like "144 usa fa pp" are often carved out of larger logs and shared on Telegram specifically because they've been filtered down to accounts believed to still be active.

Check If You Are Affected

Even a small leak like this one can expose a working password. HEROIC's free breach scanner checks your email against a database of more than 400 billion exposed records, giving you an instant answer and clear steps to secure your accounts if you're affected.