DAMN_ISRAEL OTTOHELP 126 PCS: 2,520 Stolen Credentials Exposed

DAMN_ISRAEL OTTOHELP 126 PCS May 2023: The Archive's First May Batch

May 2023 orginated two separate entries in the DAMN_ISRAEL OTTOHELP archive: this 126 PCS batch at 2,520 records, and a smaller 25 PCS batch at 618 records. Together, the May entries total 151 files and 3,138 plaintext US credentials -- the fifth month confirmed in an archive that spans January through October 2023. At approximately 20.0 records per log file, the 126 PCS batch falls in the mid-range of the archive's density spectrum, consistent with a steady, moderate-yield deployment rather than a targeted high-value sweep. All of these credentials were released publicly on October 18, 2023, five months after they were harvested.

DAMN_ISRAEL OTTOHELP 126 PCS May 2023: Stealer Log Summary

• Records Exposed: 2,520
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 18, 2023

Two May Batches: What the Split Suggests

The prevaling pattern across the DAMN_ISRAEL OTTOHELP archive is one batch per month -- but May 2023 is an exception, yielding two separate releases: 126 PCS and 25 PCS. The 126 PCS batch at ~20.0 rec/file and the 25 PCS batch at ~24.7 rec/file show slightly different densities, suggesting distinct endpoint pools from the same month. The smaller 25 PCS batch's higher density (24.7 vs 20.0 rec/file) may indicate a secondary campaign that targeted a more credential-rich machine cluster, even if it reached fewer endpoints. Taken together, May 2023 produced 151 log files and 3,138 credentials -- fewer than June's combined 7,540 but more than the January entry, acording to the confirmed series data.

Five Months Between Harvest and Release

The 2,520 individuals whose credentials appear in the 126 PCS batch were compromised in May 2023. Their data became publicly available on October 18, 2023 -- five months later. During those five months, the operator maintained exclusive access to the credentials. Whether those accounts were accessed during that window is unknown, but the risk did not end with the October release. Any credential that had not been changed by October 18 remained fully exploitable after that date, now accessible to anyone who downloaded the batch.

The DAMN_ISRAEL OTTOHELP Monthly Archive Structure

The confirmed DAMN_ISRAEL OTTOHELP monthly progression -- Jan (68 PCS), Mar (137 PCS), May (126+25=151 PCS), Jun (41+58+236=335 PCS), Sep (783+331=1,114 PCS) -- shows an operation that scaled significantly over nine months. The jump from 68 files in January to 335 combined files in June represents a nearly 5x increase in monthly file output. By September, a single batch reached 783 PCS. The confirmed months alone account for more than 44,000 records.

Check If Your Data Was Exposed

HEROIC's free breach scanner indexes more than 400 billion records including all confirmed DAMN_ISRAEL OTTOHELP archive batches. Check if your credentials appeared in this or any other release at HEROIC's breach scanner.