If Your Login Is in the 99 USA FA PP Leak, Change It Now

HEROIC analysts identified a small stealer log dataset labeled "99 usa fa pp," uploaded to a Telegram channel on June 18, 2025. The file contains 99 records made up of email addresses, plaintext passwords, and the URLs of the sites those credentials were used on. It's a modest batch, but each of the 99 entries represents a real, working login someone else now has access to.

Why This Is Dangerous

If your details are among these 99 records, someone already has your email address, your exact password in readable plaintext, and the precise website it unlocks. There's no hashing to break and no waiting involved. An attacker can use that information the moment they open the file, which is what makes even a small stealer log like this one an immediate, practical threat rather than a distant risk.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

Because these plaintext passwords are matched to specific login pages, anyone affected faces immediate account takeover risk on those exact services. If you've reused that password anywhere else, such as email, banking, or social media, attackers can attempt credential stuffing to check whether it works elsewhere too, so the damage isn't limited to a single account.

How Stealer Logs Work

Stealer logs come from infostealer malware that infects a device through phishing links, pirated software, or fake downloads. Once installed, it quietly pulls saved browser passwords, autofill data, and active sessions, then compiles the results into a log file. Small, curated batches like "99 usa fa pp" are often trimmed from larger logs and shared on Telegram because they've been filtered down to accounts the seller believes are still active.

Check If You Are Affected

Don't assume a small leak means low risk. HEROIC's free breach scanner checks your email against a database of more than 400 billion exposed records, giving you a clear, instant answer and steps to secure your account if you're affected.