346,967 Records Leaked in “Att Base” Telegram Dump: Check Now

On January 29, 2023, a file named "351k Att Base" was uploaded to a Telegram channel that circulates stolen credentials. The uploader's naming suggests roughly 351,000 records, but the actual file contains 346,967 individual entries, each pairing an email address with a plaintext password and the URL where that password was used. Despite the name, there is nothing tying this file to AT&T's own systems. It is a stealer log, built from data harvested off individually infected devices, and the "Att" label appears to be the uploader's own shorthand rather than a confirmed connection to any specific company.

Why Nearly 347,000 Exposed Logins Is a Serious Problem

Whatever the file is called, the scale here is significant. Almost 347,000 email-and-password pairs sitting in plaintext means hundreds of thousands of people have working login credentials circulating on Telegram right now, available to anyone who downloads the file.

What the "Att Base" File Actually Contains

• Email addresses
• Plaintext passwords, unprotected by any encryption
• URLs identifying the sites and services tied to each password

Why This Puts More Than Just One Account at Risk

With a file this large, criminals don't target people individually. They run automated scripts that take every email-and-password pair and test it against major banking, email, and shopping sites in bulk, a technique called credential stuffing. Because so many people reuse passwords, a leak like this one regularly leads to account takeover, identity theft, and financial fraud, often on accounts that have nothing to do with wherever the password was originally used.

How a Dump This Size Gets Built

Stealer logs at this scale are typically assembled from many separate infostealer malware infections, then merged into one large file before being uploaded and traded on Telegram. The malware runs quietly on each infected device, copying saved passwords and autofill data straight out of the browser. The result is a single dump, like this one, that represents thousands of separate victims rather than one company's breach.

Check Yourself Before Assuming You're Not Affected

With almost 347,000 records in this file, don't guess whether yours is one of them, check. HEROIC's free breach scanner searches your email against a database of more than 400 billion leaked records, including large stealer log dumps like this one, and gives you an instant answer. If you're affected, change that password everywhere you've reused it and turn on two-factor authentication right away.