Acolyte Bases Leak Exposed 3,867,400 Login Records in May

A stealer log called "Acolyte Bases" appeared on Telegram on 03-May-2026 and exposed 3,867,400 records in one single upload. That is one of the largest individual drops HEROIC has logged from this particular uploader, and it deserves a closer look.

Why This Is Dangerous

At nearly 3.9 million records, this leak is large enough to affect entire communities rather than a handful of individuals. Every one of those records includes a plaintext password, so there is no encryption layer protecting the people inside it. The scale alone means automated attack tools can chew through this file and test logins across the internet in a very short amount of time.

What Was Exposed

• 3,867,400 individual records
• Email Addresses
• Plaintext Password
• URLs matched to each account

Why This Matters

A dump this large usualy gets picked up by multiple criminal groups within days, not just the original uploader. Once a file like "Acolyte Bases" starts circulating, copies spread across forums, marketplaces and private Telegram groups, wich means the exposure only grows the longer it sits online.

How Stealer Logs Work

Bases of this size are usually built by combining logs from many separate malware infections into one master file. Whoever runs the "Acolyte" operation appears to have collected credentials from a large pool of infected devices over time, then merged them into a single release rather than posting small drops one at a time.

Check If You Are Affected

With millions of records involved, checking your own exposure only takes a minute. HEROIC's free breach scanner searches more than 400 billion compromised records, including large bases like this one, so you can confirm your status and change any exposed passwords right away.