362 Records, One Telegram Post: Inside the Gov.au Data Leak

362 records. One Telegram post. That's all it took for credentials tied to gov.au to end up circulating publicly on 18-Jun-2025, sitting in a stealer log labeled simply with the domain name.

Why This Is Dangerous

A government associated domain in a leak like this one draws more scrutiny than a typical consumer breach, and for good reason. Even a small batch of 362 records tied to gov.au could include people who handle sensitive correspondence or administrative access, meaning the potential downstream impact doesn't scale neatly with the number of records involved.

What Was Exposed

• 362 email address records tied to gov.au
• Plaintext passwords with no encryption protecting them
• URLs identifying the exact service each login accesses

Why This Matters

Its neccessary to treat any leak touching government adjacent domains with extra caution, since these accounts sometimes have access to systems well beyond a typical personal inbox. A single compromised login here could theoretically open doors that a consumer email breach never would.

How Stealer Logs Work

This kind of leak commonly starts with a phishing SMS message, sometimes called smishing, that directs the recipient to a fake login page mimicking a familiar service. Entering credentials there hands them straight to the attacker, who bundles the captured logins into a file exactly like the one that surfaced here.

Check If You Are Affected

Whether you have a gov.au email or any other account, checking your exposure only takes a moment. HEROIC's free scanner searches through more than 400 billion leaked records collected from breaches and stealer logs, including this one, and reports back instantly. If your email appears, change the password without delay.