70K USA HQ Base Zalando Target: 64,461 Logins Leaked Online

A Stealer Log Targeting Zalando Accounts Exposes 64,461 Records

On February 26, 2023, HEROIC analysts identified a stealer log dataset shared by a Telegram user under the label "70k USA HQ Base target zalando." The file contained 64,461 records, and each one combined an email address with a plaintext password and the URL of the site the login was used on, with the labeling pointing specifically toward Zalando shopper accounts based in the United States.

Why This Zalando-Targeted Stealer Log Is Dangerous

Targeted batches like this one are dangerous because they narrow the guesswork for an attacker. Instead of a random mix of sites, the credentials here are organized around a specific retailer, meaning anyone using this data already knows where to try each login first. With the password stored in plaintext, there is no cracking step standing between the attacker and the account.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs identifying the site each login was used on

Why This Matters

A retailer-focused batch like this is prime material for credential stuffing and account takeover, since attackers can move straight to testing logins against the exact type of account the data was collected from. Anyone in this batch who reuses their Zalando password on other shopping, banking, or email accounts faces a wider risk beyond the original account. The included URL makes each attempt faster and more precise for whoever is running it.

How Stealer Logs Work

Stealer logs are produced by malware that infects a device and quietly extracts saved browser passwords, autofill entries, and site URLs before sending them back to the attacker controlling the malware. Infections commonly spread through pirated software, fake installers, and malicious attachments. Once collected, the data is often sorted by target site, as this batch appears to be, and then traded on Telegram channels and dark web forums.

Check If You Are Affected

If you have a Zalando account or reuse passwords across shopping sites, it is worth checking your exposure now. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer logs like this one, and shows you exactly what has surfaced so you can secure your accounts before someone else does.