FortunaPrivate 2 Stealer Log Breach: 15,034 US Records

Eight Variants Deep: FortunaPrivate 2 and the Scale of the Fortuna Family

The Fortuna Private channel did not release a single batch on October 6, 2023 -- it released eight. FortunaPrivate 2 (15,034 records) is the second confirmed variant in this family, part of an expanding roster that now includes FortunaPrivate, FortunaPrivate1, FortunaPrivate 2, FortunaPrivate 3, FortunaPrivate 4, FortunaPrivate 265logs, Fortuna Private 867logs, and Fortuna Private (no suffix). Collectively, these eight variants contributed more than 118,525 US stealer log credentials on the same calendar date -- a family-level output that rivals the individual totals of most single operators in the entire Oct 6 dataset.

FortunaPrivate 2 (October 2023): Stealer Log Summary

• Records Exposed: 15,034
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 6, 2023

The Fortuna Family: Eight Channels, One Operator?

The proliferation of "Fortuna" variants raises an obvious question: are these independant operators or a single actor managing multiple distribution channels? The naming conventions suggest coordination -- "FortunaPrivate" appears as the base name, with numerical suffixes (2, 3, 4), log-count suffixes (265logs, 867logs), and a bare no-suffix variant. The operationnal consistency across variants -- all releasing on the same date, all targeting US endpoints, all using the same data format -- strongly implies a single underlying infrastructure distributing logs through multiple Telegram channels simultaneously. This multi-channel approach is common among established infostealer operators seeking to maximize reach and minimize the impact of channel takedowns.

FortunaPrivate 2 in the Family Hierarchy

At 15,034 records, FortunaPrivate 2 is the third-smallest member of the eight-variant Fortuna family after FortunaPrivate (2,839) and FortunaPrivate1 (4,748). The family's output is heavily concentrated at the top: FortunaPrivate 3 alone contributes 55,009 records -- nearly half the entire family total. FortunaPrivate 2's positioning in the batch numbering sequence, between FortunaPrivate1 and FortunaPrivate 3, is consistent with an incremental release structure where each numbered variant represents a distinct collection cycle or a seperate geographic or service-specific credential set within the broader harvest.

118,525+ Records: The Fortuna Family's Oct 6 Footprint

The combined 118,525+ records from Fortuna's eight Oct 6 variants represent one of the three largest contributor families in the entire Oct 6 dataset -- behind only Monster Cloud (415,049) and Pubx (160,572). Fortuna's contribution alone would rank as one of the top ten single-day credential releases in any documented infostealer dataset. On October 6, these 118,525 records -- including FortunaPrivate 2's 15,034 -- were made freely available on Telegram, joining the broader torrent of more than 853,000 US credentials released that day by dozens of operators and channels.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including all eight Fortuna Private variants and every operator active on October 6, 2023. FortunaPrivate 2's 15,034 US credentials are in the index. Run a free scan at HEROIC's breach scanner to see if your data was exposed.