A Quiet Leak: 1,476 fastmail.cn Passwords Surfaced on Telegram

What HEROIC Analysts Found

In June 2026, HEROIC analysts noticed a stealer log quietly circulating on Telegram containing 1,476 records tied to the domain fastmail.cn. There was no big announcement attached to it, no ransom note, just a file of email addresses, plaintext passwords, and login URLs sitting alongside dozens of other logs uploaded by the same user. That quiet, routine nature is exactly what makes stealer logs easy to miss.

A Small, Quiet Leak Is Still a Real One

Nobody sent a notification. No headline covered this leak. But 1,476 real people had their saved passwords copied off an infected device and shared without their knowledge. Stealer logs like this rarely make noise. They circulate quietly among people who specialize in testing leaked credentials, which is often more dangerous than a loud, publicized breach because victims have no reason to suspect anything is wrong.

What Was Exposed

• Email addresses
• Plaintext (unencrypted) passwords
• Login URLs tied to each set of credentials

Why This Matters

Because the passwords are plaintext, they work immediately without any cracking. Anyone who reused their fastmail.cn password on other accounts is exposed to credential stuffing, where the same login is quietly tested across banking, shopping, and email accounts. A compromised email can also be used to intercept password reset messages for other services.

How a Quiet Stealer Log Like This Gets Made

This data comes from infostealer malware, a type of malicious software that infects a device, often through a fake download or cracked application, and silently harvests saved browser passwords, autofill data, and active sessions. The results are packaged into a log and posted to Telegram, frequently without fanfare, where it can sit unnoticed until someone specifically searches for a domain like fastmail.cn.

Check If You Are Affected

Quiet leaks like this one are exactly why it pays to check proactively rather than wait for a headline. HEROIC's free breach scanner checks your email against a database of more than 400 billion exposed records, including stealer logs like this one, so you can find out in seconds whether your details were part of the quiet leak.