24,031 Passwords Leaked in the Numpass Stealer Log Dump

In January 2023, HEROIC analysts identified a stealer log file titled "numpass," uploaded to Telegram by an unidentified user. The file contained 24,031 records, each pairing an email address with a plaintext password and the URL of the login page the credentials were captured from.

Why the Numpass Leak Is Dangerous

This data did not come from a hacked website, it was pulled directly from infected computers, meaning the credentials were likely still in active use at the time they were stolen. Because the passwords are stored in plaintext rather than encrypted, anyone with the file can attempt to use the logins immediately.

What Was Exposed in the Numpass Log

• Email addresses
• Plaintext passwords tied to each account
• URLs showing where each credential pair was used

Why This Matters

A file of 24,031 working email and password combinations gives attackers plenty of material for credential stuffing, testing stolen logins against banking, email, and shopping sites in bulk. Anyone whose password was reused across multiple accounts is at heightened risk of having those other accounts taken over as well.

How Stealer Logs Work

Stealer logs are generated by malware planted on individual computers, frequently through cracked software, fake installers, or malicious email attachments. Once active, the malware scans the browser for saved passwords and autofill data, then exports everything into a file for the attacker. These files are then sold or given away on Telegram channels and dark web forums, which is exactly where HEROIC's analysts found this one.

Check If You Are Affected

To find out if your information appears in a leak like this, HEROIC's free breach scanner searches more than 400 billion leaked records and can tell you within seconds whether your email address has been exposed.