Inside the ‘970k’ Logs: How Malware Harvested 850,039 Passwords

In January 2023, HEROIC analysts identified a stealer log labeled "970k," uploaded by a Telegram user. HEROIC confirmed 850,039 exposed records in the file, made up of email addresses, plaintext passwords, and the URLs each login was used on.

Why the Label and the Confirmed Count Differ

Files traded under names like "970k" are often labeled by whoever compiled them based on a rough estimate before cleanup, and the real, verified number can shift once duplicates and broken entries are removed. HEROIC's confirmed count of 850,039 records reflects the actual usable data in this file, still a massive number of complete, working logins by any measure.

What Was Exposed

• Email addresses tied to each stolen login
• Plaintext passwords, stored with no encryption
• URLs identifying the exact site each credential belongs to

Why This Matters

A file of this size gives attackers enormous reach for automated credential stuffing, testing hundreds of thousands of email and password combinations against banks, email providers, and shopping sites in a matter of hours. For anyone in this file, that translates into a real risk of account takeover, financial fraud, and identity theft, particularly if the exposed password has never been changed.

How Malware Harvested 850,039 Passwords

Stealer logs like this one begin with malware quietly installed on victims' devices, often through cracked software, pirated games, or fake browser updates. Once active, the malware silently records every username, password, and web address typed into a browser and sends it back to whoever controls the infection. Reaching a file of this scale takes many thousands of individual infections, aggregated over time and combined into a single archive before being uploaded to Telegram for distribution.

Check If You Are Affected

With over 850,000 records in this single file, the odds of your information being included are real. HEROIC's free breach scanner checks your email address against a database of more than 400 billion breached and leaked records, so you can find out in seconds and secure any exposed passwords before they are used against you.