Citigroup Logins Leaked: 13,223 Users Risk Account Takeover

On June 10, 2026, a stealer log file referencing citigroup.com was uploaded to Telegram by an unidentified user, exposing 13,223 records that include email addresses, plaintext passwords, and account URLs. This was not a breach of Citigroup's own network. The data was harvested by malware running on infected personal devices, which quietly copied saved logins tied to citigroup.com before the results were compiled into a log file and shared on Telegram.

Why This Is Dangerous

Because Citigroup is a major bank, any credential associated with citigroup.com carries higher stakes than an average leaked login. The passwords in this log were captured in plaintext, so there is no encryption to break through. Anyone holding the file can attempt to log in immediately using the exact email and password pairs that were stolen.

What Was Exposed

• Email addresses
• Plaintext passwords
• Account URLs (the login pages tied to each saved credential)

Why This Matters

With 13,223 records in play, the consequences here go beyond a single inconvenience. Attackers routinely run leaked email and password combinations through credential stuffing tools aimed at banking portals, email accounts, and other financial services. If any of these citigroup.com credentials were reused elsewhere, the people behind this leak now have a direct path to account takeover, identity theft, and financial fraud, especially where banking access is involved.

How This Stealer Log Leak Happened

Stealer logs come from information-stealing malware, usually delivered through pirated software, fake downloads, or phishing attachments. Once installed, the malware scrapes saved passwords and autofill data straight out of the browser on the infected device and sends it to the attacker. The attacker then bundles everything into a log file, which gets sold or dumped on Telegram channels, exactly what happened with this citigroup.com dataset.

Check If You Are Affected

If you have ever logged into a citigroup.com account, take a moment to check whether your details are part of this leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer logs like this one, so you can find out immediately and secure your accounts before someone else gets there first.