The ee 22.3 Exposed 18,542 Stolen Accounts on the Dark Web

HEROIC analysts identified this stealer log on April 24, 2023. The breach exposed 18,542 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as ee 22.3.

Why This Is Dangerous

This stealer log contains plaintext passwords tied to real email addresses. Because the passwords are fully readable, anyone who obtains this file can immediately attempt to log in to the listed accounts. The URLs included in the breach also identify exactly which websites or services were targeted.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs (website addresses where credentials were stolen)

Why This Matters

The 18,542 credentials in this breach can be used in credential stuffing attacks, where automated tools try stolen usernames and passwords across hundreds of websites at once. If a victim reused their email password on banking, healthcare, or social media accounts, those accounts are all at risk. Account takeover from a single leaked password can cascade into identity theft and financial loss.

How Stealer Logs Work

Stealer log malware installs on a victim's computer through phishing links, malicious email attachments, or compromised software downloads. Once active, it extracts saved passwords from web browsers and records credentials as the user logs into websites. The stolen data is packaged and shared in dark web markets and private Telegram groups.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.