The 22K Mix Stealer Log Exposed 21,919 US-Based Account Holders

HEROIC analysts catalogued the 22K Mix stealer log on February 22, 2026, containing 21,919 stolen email and password pairs. With a US country listing and a mix of web service credentials, this file expozed accounts belonging to people across the United States who use popular online platforms on a daily basis.

Why the 22K Mix Breach Is Dangerous

A US-focused mix credential file gives buyers a pool of active accaunts on platforms popular with American users, including e-commerce sites, streaming services, and social media. Each record in the 22K Mix file includes the URL where the credential was captured, meaning attackers know exactly which US-based service each stolen login belongs to.

What Was Exposed in the 22K Mix Leak

• Email Addresses
• Plaintext Passwords
• URLs (specific services where each credential was captured)

Why This 22K Mix Data Puts You at Risk

With nearly 22,000 records targeting mulitple US-based services, the 22K Mix file represents a broad attack on everyday account holders. Victims include people who shop online, use streaming services, and manage their finances through web portals. Attackers with this file can attempt logins across all of these categories simultaneously using automated tools.

How Stealer Logs Work

Mix files like the 22K dump are assembled by malware operators who aggregate credentials from infected machines across a target region. Each infected computer sends stolen login data back to the operator, who then filters and packages it by country or service type. US-focused files are in high demand because American users typically have active accounts on high-value financial and retail platforms.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the 22K Mix dump or thousands of other breaches in our database.