Our Analysts Found the Centurion.txt Dump With 5.9M Stolen Logins

On June 28, 2026, HEROIC analysts found a stealer log file named "Centurion.txt" circulating in a Telegram channel used to trade stolen data. The file was massive, containing 5,908,374 records that pair email addresses with plaintext passwords and the URLs of the accounts they unlock. Its one of the largest single stealer logs our team has flagged this month, and it landed in the hands of anyone in that channel the moment it was posted.

Why the Centurion.txt Dump Is Dangerous

With nearly six million records in one file, Centurion.txt gives an attacker an enormous head start. Because the passwords are stored in plaintext and matched directly to the site they belong to, there is no cracking or guessing involved. An attacker can simply pull entries out of the file and test them against real login pages, and at this scale, even a small success rate still means tens of thousands of accounts compromised.

What Was Exposed in the Centurion.txt File

• Email addresses tied to millions of real accounts
• Plaintext passwords stored without any encryption
• URLs showing precisely which website or service each login unlocks

All together, 5,908,374 records were bundled into this single Telegram upload, making it one of the larger stealer logs HEROIC has tracked recently.

Why a Leak This Size Matters for Everyday Accounts

A file of this scale doesnt stay confined to one Telegram channel for long. Copies spread quickly, get merged into larger combolists, and fuel automated credential stuffing campaigns that test millions of email and password pairs against banking sites, email providers, and online retailers in a matter of hours. Anyone caught in the Centurion.txt data faces a genuine risk of account takeover, financial fraud, and identity theft, especially if they reused that password anywhere else.

How a Stealer Log the Size of Centurion.txt Gets Built

Large stealer logs like this one are usually the product of a widespread malware campaign rather than a single infected machine. The malware spreads through cracked software, fake updates, and phishing links, quietly pulling saved passwords and autofill data from every infected browser it touches. Those individual harvests get combined into one master file, which explains how a single upload can contain records tied to so many unrelated websites and services.

Check If You Are Affected by the Centurion.txt Leak

HEROIC's free breach scanner checks your email against more than 400 billion compromised records, including large-scale logs like Centurion.txt. Run a free scan today, and if your information turns up, change that password right away and turn on multi-factor authentication wherever it's available.