The 15k USA Stealer Log Exposed 14,173 American Email Accounts

The "15k USA" Stealer Log Exposed 14,173 American Accounts

In April 2026, HEROIC analysts tracked a stealer log labeled "15k USA" being shared on Telegram, containing 14,173 records tied to United States-based accounts. Each record includes an email address, a plaintext password, and the URL where that password was used, the standard structure of malware-harvested login data.

Why This Is Dangerous for Everyday Americans

Unlike a breach of a single company's database, this file was not limited to one site. It is a collection of whatever logins the underlying malware found saved in each infected browser, meaning the 14,173 exposed accounts likely span email, retail, banking, and social platforms alike. Because the passwords are stored in plaintext, anyone who gets the file can start using them immediately, no cracking required.

What Was Exposed in the "15k USA" Dump

• Email addresses belonging to United States-based accounts
• Plaintext passwords with no hashing or encryption
• URLs identifying exactly which site each password unlocks

Why This Matters for the 14,173 People in This Dataset

With 14,173 working email-and-password pairs, this file is large enough to fuel automated credential stuffing attacks against banks, retailers, and email providers across the country. Anyone in this dataset who has reused a password elsewhere is at risk of account takeover, fraudulent purchases, or having their own email used to reset passwords on other accounts they hold.

How a 14,173-Record Stealer Log Comes Together

Stealer malware infects a device, often through a pirated download or malicious attachment, and quietly copies out every password saved in the browser along with the site it belongs to. The operator behind this particular log gathered enough United States-tied credentials to reach 14,173 records, packaged them under the label "15k USA," and distributed the file through Telegram a few months after the initial infections.

Check If You Are Affected

If you are based in the United States, it is worth checking whether your email appears in this leak or any other. HEROIC's free breach scanner searches more than 400 billion exposed records in seconds, so you can confirm your exposure and reset any reused passwords before someone else beats you to it.