268,179 US Accounts Hit in the Xavier_Group Stealer Log Leak

Two hundred sixty eight thousand, one hundred seventy nine. That's how many records turned up in the Xavier_Ulp - 420719 Xavier_Group file a Telegram user posted on December 24, 2025, and the accounts inside were tied to the United States.

Why This Is Dangerous

When a leak this size lands with a clear US concentration, it becomes an easy target list for attackers who want to focus their efforts. Instead of spraying stolen credentials at random accounts around the world, they can narrow in on American banks, retailers, and email providers where these logins are most likely to still work.

What Was Exposed

• 268,179 total records
• Email Addresses
• Plaintext Passwords
• URLs linked to United States based accounts

Why This Matters

A leak of this scale, imediately available to anyone on Telegram, means hundreds of thousands of people could see fraudulent charges, hijacked email accounts, or locked out logins in the days and weeks after a file like this surfaces. Attackers can't asume every account still works, but with 268,179 tries, even a small success rate adds up to a lot of victims.

How Stealer Logs Work

Stealer log malware doesn't care where you live, but it does keep track of your location through your saved browser data and IP address, wich is how leaks like this one end up clustered by country. The malware infects a device, harvests everything from saved passwords to autofill fields, and ships it back to whoever is running the operation.

Check If You Are Affected

If you're in the United States, a leak like this is worth taking seriously. HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including this one, so you can find out and change your passwords before an attacker does.