49,363 Bt.com Passwords Leaked: Identity Theft Risk Grows

In June 2026, HEROIC's dark web analysts identified a stealer log uploaded to Telegram on 10-Jun-2026 containing 49,363 records tied to bt.com. The log included email addresses, plaintext passwords, and the URLs of the sites those credentials were captured on, information typically lifted directly from an infected device's saved browser data before being compiled and shared.

Why This Bt.com Stealer Log Leak Is Dangerous

With 49,363 individual login records in one file, this log gives an attacker a huge, ready-to-use list of working email and password combinations, each already matched to the exact site it unlocks. That scale means automated tools can work through the entire list quickly, testing every account with minimal effort.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

Because these passwords are stored as plaintext, they can be used immediately, without any cracking or decoding. If people among these 49,363 records reused their bt.com password anywhere else, attackers can exploit that through credential stuffing, systematically trying the same login across other websites, and a compromised email account in particular can be used to reset passwords elsewhere, opening the door to broader identity theft.

How Stealer Logs Work

Stealer logs are produced by infostealer malware, which usually spreads through fake downloads, pirated software, or malicious email attachments. Once it infects a device, it quietly copies saved passwords and browsing data from the browser and sends it back to the attacker. That information is compiled into a log file and distributed, in this case uploaded straight to a Telegram channel.

Check If You Are Affected

If you use a bt.com email address or have logged into any account with it, it is worth checking whether your details are in this log. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records in seconds, so you can find out right away and secure any exposed accounts before they are misused.