2.2KK Streaming Private Base: 2.2M Records, a City’s Size

2,199,225 Records Exposed in a Streaming-Focused Stealer Log

On February 28, 2023, HEROIC analysts identified a stealer log dataset shared by a Telegram user under the label "2.2KK Streaming Private Base." The file contained 2,199,225 records, roughly the population of a major U.S. city, and each one paired an email address with a plaintext password and the URL of the streaming site that login was used on.

Why This Stealer Log Is Dangerous

A dataset of this size means over two million people each have a complete, working login sitting in a single file. The passwords are stored in plaintext, so there is no cracking required, and the matching URL removes any guesswork about which streaming account each credential unlocks.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs identifying the site each login was used on

Why This Matters

Streaming account passwords are commonly reused on other, more sensitive accounts, which makes this dataset well suited to credential stuffing, where the same login is automatically tested across banking, shopping, and email services. Anyone among these 2,199,225 people who reused their password faces a real risk of account takeover far beyond the streaming account originally exposed. The included URL also gives an attacker a precise starting point rather than having to guess.

How Stealer Logs Work

Stealer logs come from malware that infects a device and quietly copies saved browser passwords, autofill data, and site URLs before sending it all back to the attacker running the malware. Common infection routes include pirated software, fake installers, and malicious attachments. Once collected, data like this is often sorted by category, such as streaming accounts, and then traded across Telegram channels and dark web forums.

Check If You Are Affected

With over 2.1 million records in this leak, checking your exposure is worth doing right now. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer logs like this one, and shows you exactly what has surfaced so you can secure your accounts before someone else does.