3,210 Passwords Leaked Online in RACSA.co.cr Data Breach

3,210 Records Exposed in RACSA.co.cr Stealer Log

In June 2026, HEROIC analysts uncovered a stealer log file uploaded to Telegram that exposed 3,210 records tied to racsa.co.cr. The file surfaced on 10 June 2026 and contains email addresses, plaintext passwords, and the URLs those credentials were entered on, all pulled straight from infected devices.

Why This Stealer Log Is Dangerous

With 3,210 records in a single file, this is a sizable batch of ready-to-use credentials. Because the passwords are stored in plaintext and matched to specific login URLs, an attacker does not need to crack or guess anything, they can simply plug the email, password, and web address in and gain access immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs associated with the logins

Why This Matters

Plaintext passwords tied to login URLs are prime fuel for credential stuffing and account takeover. If any of the 3,210 people in this dump reused their password on other sites, such as email, banking, or shopping accounts, an attacker could use this single leaked password to break into multiple parts of their online life.

How Stealer Logs Work

Stealer logs are generated by infostealer malware, malicious software that infects a device, often through a phishing link or fake download, and quietly copies everything saved in the browser: usernames, passwords, cookies, and autofill data. Criminals then bundle that stolen information into a log file and sell or trade it on Telegram channels and dark web forums, which is how this racsa.co.cr data came to light.

Check If You Are Affected

To find out if your information is part of this leak or any other, run HEROIC's free breach scanner. It checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one, so you can quickly see if your credentials need to be changed.