Exactly 4,754 Records Leaked In Second Xavier_Group Log #190

Exactly 4,754. That's the precise record count in a second file also labeled Xavier_Log - 190 Xavier_Group Premium, uploaded the same day, 15-Apr-2026, as another batch carrying the identical name. Same label, different file, and thousands more people caught up in it.

Why This Is Dangerous

When two files share a name but carry different record counts, it usually means the same infection campaign is being sliced up and released in stages. Anyone whose data landed in this batch should treat it with the same urgency as any imediately actionable leak, because the plaintext passwords inside are ready to use as-is.

What Was Exposed

• Email Addresses
• Plaintext Password
• URLs
• 4,754 total records exposed

Why This Matters

Files that get labeled and re-released like this suggest the group behind them is actively managing thier stolen data like inventory, doling it out over time rather than dumping everything at once. That pattern often means more related files are still to come.

How Stealer Logs Work

Stealer malware doesn't stop collecting after one session. As long as it stays installed on an infected computer, it keeps grabbing new saved passwords every time the victim logs into another account. That's part of why the same source name can produce multiple separate files over time, each one a fresh export of whatever the malware picked up since the last batch.

Check If You Are Affected

Two files, thousands of records, and no way to know if you're in one of them without checking. HEROIC's free breach scanner compares your email against more than 400 billion leaked records so you get a clear answer right away.