The J COUNTRY Leak: 692 Stolen Credentials Hit the Dark Web

In June 2023, a Telegram-based threat actor published a stealer log file under the DIAMOND_logscloud collection that compromised 692 individuals across the J COUNTRY dataset. The exposed records included email addresses, plaintext passwords, and the URLs of the services victims were actively using when malware harvested their credentials. This breach occured silently on infected devices, with no warning sent to any of the victims. HEROIC has confirmed this data remains accessible to criminal operators nearly three years later.

Why This Is Dangerous

When criminals hold plaintext passwords alongside email addresses, they can launch immediate login attempts across banking, retail, and social platforms without any additional effort. The combination of email plus password is the master key to a victim's digital life, and attackers know exactly how to exploit it. Victims of stealer log breaches often discover the damage only after unauthorized transactions or account lockouts have already occured.

What Was Exposed

• Email Addresses: Used as login identifiers across hundreds of online services, making them the entry point for account takeover attempts.
• Plaintext Passwords: Captured in unencrypted form directly from device memory or browser storage, requiring zero additional effort from attackers.
• URLs: Records of the exact sites and services accessed by victims at the time of infection, giving criminals a roadmap of which accounts to target first.

Why This Matters

Even a dataset of 692 records can generate substantial fraud when victims reuse passwords across banking, email, and e-commerce accounts. Stealer log data is prized by criminal networks precisely because the passwords are in plaintext and were verifyed working at the time of theft. Victims whose information appears in this collection remain at elevated risk for as long as they continue using the same compromised credentials across any online service.

How Stealer Log Works

Stealer log malware is a category of information-stealing software that runs silently on a victim's device, harvesting saved credentials, browser autofill data, and active session tokens. Unlike breaches that target company databases, stealer logs bypass server-side security by capturing data directly from the user's machine. The malware responsible for this collection likely spread through phishing emails, cracked software downloads, or malicious browser extensions. After harvesting credentials, the attackers compiled them into structured log files and uploaded them to Telegram for distribution among criminal comunities.

Check If You Are Affected

HEROIC's free dark web scanner searches more than 400 billion exposed records, including stealer log collections like this J COUNTRY DIAMOND_logscloud dataset. Visit heroic.com to run your free scan and immediately learn whether your email address or passwords have been exposed. Taking action now, before criminals do, is the most effective way to protect your online accounts from takeover fraud.