Exactly 31,818 Records Turned Up in the USA_3 Randomize Leak

The filename usa_3_100000_randomize promises 100,000 records, but when HEROIC checked the actual file uploaded to Telegram in February 2026, the verified count landed at exactly 31,818. That precise, unglamorous number is still 31,818 real people whose email addresses and passwords are now sitting in a file anyone can download.

Why This Is Dangerous

It's tempting to focus on the gap between the advertised 100,000 and the real 31,818, but that gap doesn't make the leak less serious. Every one of those 31,818 entries is a working login, and the randomized naming was likely meant to make the file look like part of a bigger, ongoing series.

What Was Exposed

• 31,818 total records
• Email addresses
• Plaintext passwords
• URLs tied to each account

Why This Matters

Files labeled "randomize" often mean the uploader shuffled and split a larger source list into smaller chunks, seperate from each other, to distribute across multiple posts or channels. This kind of staggered release has occured with several other "randomize" labeled files HEROIC has tracked. That approach spreads the exposure out over time, so victims might not realize their data is circulating until months after the original theft.

How Stealer Logs Work

This kind of file typically starts as a stealer log collection, targeting a specific country or region, in this case the United States. The malware harvests saved browser credentials, and the operator then sorts, randomizes, and splits the data into numbered parts before sharing each individual chunk on Telegram over time.

Check If You Are Affected

Don't assume you're safe just because this file undercounted its own name. HEROIC's free breach scanner searches over 400 billion leaked records, so you can definately check whether your email turned up in this leak or any other, in just a few seconds.