One Archive. 61,505 Logins. The DataMonk Part 2 Leak Landed.

61,505 Logins Exposed in the DataMonk Part 2 Archive

HEROIC analysts found a stealer log file, labeled "DataMonk_file 12070 File In Rar.part2," uploaded to a Telegram channel on 26 Jul 2026. This second file in the DataMonk archive contained 61,505 records taken directly from infected devices, including email addresses, plaintext passwords, and the URLs of the accounts those logins open.

Why This Is Dangerous

This data was not stolen from one company's servers. It was gathered piece by piece from individual infected computers, then compiled into a multi-part archive under the DataMonk name. Because the passwords are stored as plaintext and matched to specific site URLs, anyone who gets hold of this file can log straight into the accounts listed without needing to crack or guess a single password.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

With over 61,000 plaintext credentials in this file alone, criminals have a large, ready-to-use list for automated login attempts across banking sites, email accounts, and social media platforms. If anyone in this file reused their password elsewhere, the same credentials can unlock other accounts too, which is exactly how credential stuffing, account takeover, and identity theft campaigns get their start.

How Stealer Log Archives Like This Are Built

Files like the DataMonk archive are built from information stealing malware that infects victims through cracked software, malicious email attachments, or fake update prompts. The malware quietly copies saved browser passwords, autofill data, and session details, then reports back to whoever controls it. Operators often combine logs from many infections into a single compressed archive, split across multiple parts like this part2 file, before distributing them through Telegram channels and dark web marketplaces.

Check If You Are Affected

To see whether your email or passwords appear in this leak or any other, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. It takes less than a minute to check your exposure and get clear next steps to secure your accounts.