Belarus 3 Leak: 183,955 Stolen Passwords and Emails Exposed

In December 2022, HEROIC analysts identified a large stealer log dump uploaded to a public Telegram channel under the label "Belarus 3," the third installment in a regional series of leaked credential batches. This file alone contained 183,955 exposed records, each pairing an email address with a plaintext password and the login URL it unlocks, harvested from individually infected devices rather than a single company's servers.

Why This Regional Batch Is Dangerous

Grouping stolen credentials by region, as this file's name suggests, lets attackers target campaigns more precisely, focusing phishing, credential stuffing, or account takeover attempts on accounts likely to share a language, currency, or set of local services. With 183,955 plaintext email and password pairs in one file, an attacker needs no cracking or guessing to start using them immediately.

What Was Exposed in the Belarus 3 Log

• 183,955 email addresses used as account logins
• Matching plaintext passwords for each email
• The login URL or endpoint each credential pair unlocks

Why This Matters

A working email and password pair is rarely used on just one site. Attackers load lists like this into automated credential stuffing tools that test each pair across banking, email, and shopping platforms, since so many people reuse the same password across services. For anyone in this batch, that risk translates directly into account takeover, financial fraud, and identity theft, especially if the leaked password is still in use anywhere else.

How a Dump Like "Belarus 3" Gets Built

Batches like this one are compiled from information-stealing malware that infects individual devices, often through pirated software, cracked games, or malicious downloads. Once installed, the malware quietly copies saved browser passwords and autofill data and reports it back to whoever controls it. Sellers then sort these logs by region or country, releasing them in numbered parts, like this third "Belarus" installment, before distributing them for free or for sale on Telegram.

Check If You Are Affected

With nearly 184,000 records in this single batch, checking your exposure only takes a moment. HEROIC's free breach scanner searches your email against a database of more than 400 billion leaked and stolen records, including stealer logs like this one, so you can find out in seconds if your credentials have surfaced online.