Three Months Later, 2.28M Facebook Logins Surface Online

The credentials in this file were first collected on 15-Jun-2026, but HEROIC analysts did not log it into the system until three months later. In that gap, 2,279,752 email and plaintext password pairs tied to Facebook logins sat circulating on Telegram, all of them confirmed genuine. That is a long window for reused passwords to be tested, which is why it is worth a scan your email right now.

Why Months of Delay Make This More Dangerous

The longer a credential file sits in circulation before account holders find out, the more chances an attacker has had to test it. At this scale, automated tools can run millions of login attempts against Facebook and other major services in a fraction of the time it took for this file to surface publicly.

What This Large File Contained

• Email addresses: identify the account tied to each password and support phishing follow up.
• Plaintext passwords: usable immediately, with no cracking needed at this scale.
• Login URLs: confirm the credentials were harvested specifically for Facebook logins.

Why the Timeline Matters as Much as the Count

2,279,752 records is already a serious number on its own, but a three month gap between collection and detection means the credentials have had time to be copied, resold, and merged into other lists. Anyone who has not changed a reused password since June is still exposed today.

How a File This Size Comes Together Over Time

Combolists of this scale are usually built up gradually, combining credentials from multiple smaller leaks and malware logs into one master file before being posted as a single upload. The delay between the earliest captured entries and the public posting date is common, and it is exactly why ongoing monitoring matters more than a one time check.

Were You Exposed in the Months This Sat Unreported?

Scan your email to see if your address is among the 2,279,752 records in this file or in any other leak HEROIC tracks. If you find a match, change your Facebook password immediately, review any other account using the same password, and turn on multi-factor authentication everywhere it is available. Check both personal and work email addresses, since large files like this rarely separate the two.