Plaintext Passwords Leaked in LOGS_CENTER_NEW February 2026 Breach

What Happened

On February 23, 2026, an anonymous Telegram user uploaded "2026.02.23 - LOGS_CENTER_NEW", a fresh stealer log archive branded under the LOGS_CENTER operation. LOGS_CENTER runs a regular Telegram publication cadence, releasing daily packs of infostealer output to drive traffic to its paid subscription tier. This particular drop exposed 43,790 records, making it one of the largest single-day LOGS_CENTER releases this year.

Data Exposed

The archive contains 43,790 records, each bundling an email address, the corresponding plaintext password, and the URL of the compromised service. The passwords are not hashed, salted, or encrypted: they are the exact character strings users typed into login forms. Targeted services include Gmail, Outlook, Yahoo, Facebook, Instagram, TikTok, PayPal, Amazon, online banks, cryptocurrency exchanges, corporate VPNs, and workplace SaaS tools.

How the Breach Happened

LOGS_CENTER aggregates output from multiple affiliates running infostealer malware such as RedLine, Lumma, StealC, and Vidar. Victims usually get infected by downloading cracked software, fake Chrome updates, malicious browser extensions, or attachments from phishing emails. Once the malware executes, it scrapes saved browser credentials, cookies, autofill fields, crypto wallets, VPN configs, and session tokens, then uploads the haul to an operator-controlled panel for packaging and resale.

Who Is Affected

The 43,790 records represent 43,790 individual victim sessions, primarily in the United States with global coverage. Anyone whose PC was infected with an infostealer in the weeks leading up to February 23, 2026 may be represented. Impact extends beyond the victims themselves because leaked passwords are often reused across accounts, enabling credential stuffing attacks on services that were never directly involved in the infection.

What To Do Now

Because plaintext passwords were leaked, assume immediate compromise of every account whose password was saved in your browser. Rotate passwords starting with email, banking, and work accounts. Enable authenticator-app 2FA on every critical service. Run a full malware scan with a reputable engine, clear browser-saved credentials, revoke active sessions, and replace any API keys stored in browser extensions or clipboard history.

Check If You Are Affected

HEROIC's free dark web scanner ingests LOGS_CENTER drops as they appear on Telegram. Enter your email to see whether it appears in the February 23, 2026 pack and receive guided remediation steps for each exposed account.