How EXPERTLOGS Bases5 Ended Up Leaking 99,985 Credentials

EXPERTLOGS Bases5 reads like a product name because, in a sense, it is one. Dated February 13, 2023, this Telegram upload holds 99,985 records, just shy of six figures, each one an email paired with a plaintext password and the URL it unlocks.

Why This Is Dangerous

Names like EXPERTLOGS suggest an operation that treats stolen data as a product line, cataloged, numbered, and sold in batches. A file this organized and this large is built for efficient reuse, meaning the credentials inside get tested against multiple targets almost as soon as the file changes hands.

What Was Exposed

• Nearly 100,000 email addresses from various accounts
• Plaintext passwords matched to each address
• URLs showing where each set of credentials applies

Why This Matters

A branded, numbered series like Bases5 suggests there are other batches out there too, meaning this leak is likely one piece of a larger ongoing operation rather than an isolated event. If your data is in this one, its worth wondering wether it's also sitting in Bases1 through 4, or whatever comes after.

How a Log This Size Gets Assembled

Operations that produce numbered log series typically run infostealer malware as an ongoing campaign, infecting new devices continuously through cracked software sites, fake downloads, and malicious ads, then bundling harvested credentials into fresh batches on a schedule, hence the sequential naming.

Check If You Are Affected

With nearly 100,000 records in play, the odds of exposure are real. Run a free scan with HEROIC against its database of over 400 billion leaked records to see if you're one of the 99,985.