20k France Base Uploaded by a Telegram User: 17,447 Passwords Leaked

HEROIC analysts identified a stealer log dataset, referred to as "20k France base uploaded by a Telegram User," that surfaced on February 11, 2023. The file was posted directly to a Telegram channel by a user distributing malware-harvested credentials, and it contains 17,447 records made up of email addresses, plaintext passwords, and the URLs of the websites those logins belong to.

Why This Is Dangerous

This isn't a hacked database of scrambled password hashes. It's the raw output of infostealer malware, meaning every password in this file is stored in plaintext, exactly as the victim typed it. Paired with the matching email address and the exact website URL it was used on, an attacker doesn't need to guess or crack anything. They can copy the credential pair directly into a browser and log in as the victim within seconds.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

Because the passwords are in plaintext and already linked to specific login pages, this data is immediately usable for account takeover on the exact services listed. If any of those 17,447 people reused the same password on email, banking, or social media accounts, attackers can attempt credential stuffing across those platforms too, turning one leaked login into access to many.

How Stealer Logs Work

A stealer log is generated by infostealer malware, malicious software that quietly installs itself on a victim's computer, often through a fake download, cracked software, or phishing link. Once running, it scans the browser's saved password vault, autofill data, and active login sessions, then packages everything it finds into a single log file. That file is uploaded to a server or, as in this case, shared directly in a Telegram channel where other criminals can pick it up and start using the credentials right away.

Check If You Are Affected

If you're unsure whether your email or passwords appear in this stealer log or any other breach, HEROIC's free breach scanner checks your details against a database of more than 400 billion exposed records. It takes seconds to run and gives you a clear answer, along with guidance on what to change if you're affected.