The Codetel.net.do Log Put 12,569 Stolen Credentials Online

HEROIC analysts identified this stealer log on 10-Jun-2026. The breach exposed 12,569 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as codetel.net.do, the domain of Codetel, a major telecommunications provider in the Dominican Republic.

Why This Is Dangerous

Telecom provider credentials are particularly sensitive because they often gate access to account management portals, billing information, and phone services. With 12,569 plaintext passwords exposed alongside email addresses and the exact URLs where they were used, attackers have a ready-made toolkit for account takeovers. Customers who reused these passwords on other sites are also exposed beyond their telecom account.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (the specific websites where credentials were active)

Why This Matters

With over twelve thousand credential pairs available to criminals, this is a large-scale exposure that affects a significant portion of Codetel's customer base. Attackers can use stolen telecom credentials to redirect phone numbers, intercept two-factor authentication codes, access billing records, and carry out identity theft. Credential stuffing attacks on other platforms are also a direct risk for anyone who reused the same password elsewhere.

How Stealer Logs Work

Stealer malware is typically delivered through phishing emails, malicious software downloads, or pirated applications. Once it runs on a device, it silently reads passwords saved in the browser, captures the associated web addresses, and transmits everything to the attacker. The victim sees nothing unusual. The attacker then uploads the resulting file to Telegram, where it circulates among criminal networks.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.