American Accounts at Risk: Forth Base Leaks 9,988 Passwords

HEROIC analysts identified a stealer log file titled "30-JUNE FORTH BASE" that was shared on Telegram on June 30, 2026. The file contains 9,988 records, each comprising an email address, a plaintext password, and the URL of the service where the credential was intercepted. The dated naming convention suggests this is part of a recurring series of credential dumps released by the same threat actor, with the "FORTH BASE" identifier serving as a campaign or collection name.

With nearly 10,000 records, this represents a significant credential exposure. The plaintext format of every password in the file means all 9,988 accounts are immediately vulnerable to unauthorized access without any additional effort from attackers.

Why Plaintext Passwords at This Scale Demand Urgent Response

Every password in the Forth Base stealer log is stored in plaintext — completely readable and requiring no decryption, cracking, or computational effort to exploit. At nearly 10,000 records, this provides attackers with a substantial arsenal of working credentials that can fuel days of automated credential stuffing campaigns.

The volume also attracts more sophisticated threat actors. Smaller stealer logs may be used by individual attackers, but a file approaching 10,000 plaintext credentials is large enough to power organized cybercrime operations that systematically test credentials across hundreds of services simultaneously, maximizing the number of accounts compromised per record.

What Was Exposed in the Forth Base Dump

• Email Addresses — Nearly 10,000 email accounts from various providers, each serving as a login identifier and potential entry point for account takeover across multiple services.
• Plaintext Passwords — Fully readable credentials captured from infected devices, each one immediately usable without any decryption or processing.
• URLs — The login pages and services where each credential was harvested, confirming which accounts are directly compromised and mapping victims' online activity.

Why 9,988 Credentials Create Industrial-Scale Exposure

At this volume, the Forth Base dump enables automated attacks at an industrial scale. Credential stuffing botnets can process thousands of login attempts per minute across multiple target services. With nearly 10,000 confirmed email and password pairs as input, these automated tools can compromise accounts faster than individual users can change their passwords.

Password reuse amplifies this scale dramatically. If even half of the 9,988 individuals reuse their password on just three additional services — a conservative estimate based on research showing over 60% reuse rates — the true exposure could exceed 25,000 compromised accounts across the internet. Each day these credentials remain active, the damage expands.

How Dated Stealer Log Releases Indicate Ongoing Operations

The "30-JUNE" prefix in this file's name reveals an important detail about the threat actor's operations. Date-stamped releases suggest a systematic, recurring process where new stealer log batches are compiled and distributed on a regular schedule. This indicates an active malware campaign that continues to infect new devices and harvest fresh credentials.

Infostealer malware quietly operates on infected devices, capturing credentials from browser sessions, saved password stores, and authentication cookies. The stolen data flows through an organized pipeline: collection, compilation, and distribution on platforms like Telegram. The Forth Base release represents just one installment from what appears to be an ongoing operation that may produce similar dumps on a regular cadence.

Check If Your Credentials Were Exposed

With a leak of nearly 10,000 records, the probability of any given internet user being affected is not insignificant. HEROIC's free breach scanner searches more than 400 billion compromised records to check whether your email appears in the Forth Base dump or any other known breach.

If your credentials are found, act immediately. Change the affected password and any other accounts sharing the same credentials. Enable two-factor authentication on all important services, review recent login activity for signs of unauthorized access, and scan all your devices for malware to stop any active infostealer infections.