194597 Records from facebook.com Leaked in Stealer Log Attack

In December 2023, a Telegram user uploaded a stealer log file containing nearly 200,000 records tagged with the domain facebook.com, making this one of the larger credential dumps of its kind to circulate on public channels that year. The records came from users in the United States and included live plaintext passwords alongside email addresses and login URLs, meaning the underlying malware captured the credentials as people signed into their accounts rather than by breaking into Facebook's own systems.

Why This Is Dangerous

Because this batch of stolen credentials points to a platform as widely used as Facebook, the implications go well beyond any single account. Many people connect their login to other apps and services through single sign-on, so a compromised set of credentials can open more than just one profile. The passwords in this dataset are plaintext, which means they are ready to use immediately: no cracking tools, no rainbow tables, nothing. With 194,597 records, even a low success rate translates to a large number of successful logins.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the login pages the credentials were used on

Why This Matters

A dataset this size does not stay in one place. Once a stealer log with 194,000 records is uploaded to a Telegram channel, it gets downloaded, copied, and shared across underground forums within hours. These credentials end up in bulk databases that automated credential stuffing tools draw from when attacking popular websites. Even if you changed your password the same day this was posted, the old credentials remain a permanent fixture in the underground credential market, and reusing that password anywhere else is the biggest risk factor for anyone in this dataset right now.

How Stealer Log Breaches Work

Infostealer malware is designed to run quietly on a compromised device and harvest every set of credentials it can find. It pulls saved passwords from browsers and captures keystrokes during active logins, and login pages for major platforms are a common target simply because they are present on nearly every consumer device. Once collected, the data is packaged into a log file and either sold privately or uploaded to public distribution channels like Telegram, where it can reach a large audience instantly. This kind of attack targets the endpoint the malware infects, not the security of the platform whose login page appears in the data.

Check If You Are Affected

With nearly 200,000 records in this leak, the chances that someone you know was affected are real. You can check your email address against this and thousands of other known breaches for free using HEROIC's breach checker at heroic.com. If your information shows up, change your passwords immediately and enable two-factor authentication on any accounts that support it.