9,665 ATM Records Leaked — Passwords and Emails Exposed

HEROIC found the ATM stealer log on August 30, 2023, exposing 9,665 records containing email addresses, plaintext passwords, and URLs.

Why the ATM Breach Is Dangerous

The ATM stealer log is a Telegram-distributed credential dataset harvested from compromised devices in late 2023. With 9,665 URL-paired plaintext password records, this dataset provides attackers with precisely targeted credentials for specific websites and services. Though smaller in scale than large combolists, stealer log entries like these are typically more recent and more accurate than older breach data, making them especially dangerous for active account compromise.

What Was Exposed in the ATM Leak

• Email Addresses -- 9,665 user account identifiers stolen from active browser sessions
• Plaintext Passwords -- working credentials requiring no decryption or cracking
• URLs -- the exact websites and services where each credential pair was captured

Why This ATM Data Puts You at Risk

Credentials from stealer logs like ATM are typically current at the time of collection, meaning any accounts that still use the same passwords from August 2023 are at immediate risk. Attackers use URL-paired credentials to target specific platforms -- banking sites, email providers, and streaming services -- rather than running blind credential stuffing. This makes each entry in the ATM log a precisely targeted attack vector.

How Stealer Logs Work

Stealer logs are created by infostealer malware that infects a victim's device and silently extracts saved browser passwords, session cookies, and autofill data. The harvested credentials are packaged and shared via Telegram channels, often by threat actors using short code names or acronyms like ATM. These datasets circulate on dark web forums and criminal marketplaces where they are used to conduct targeted account takeover campaigns against individuals and businesses.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the ATM stealer log or thousands of other breaches in our database.