FortunaPrivate 4: 8,195 US Credentials — Seventh Fortuna Variant on Oct 6, 2023

FortunaPrivate 4: Seventh Confirmed Fortuna Variant on October 6, 2023

FortunaPrivate 4 adds 8,195 US credentials to the Fortuna family's already substantial October 6, 2023 total. With seven confirmed Fortuna variants now identified on that day -- FortunaPrivate (2,839), FortunaPrivate1 (4,748), FortunaPrivate 3 (55,009), FortunaPrivate 265logs (3,174), Fortuna Private 867logs (15,262), Fortuna Private no-suffix (14,264), and FortunaPrivate 4 (8,195) -- the family's combined Oct 6 contribution exceeds 103,000 records. This makes the Fortuna family the third-largest Oct 6 operator group by volume, behind only Monster Cloud (404,809 across 29 batches) and Pubx (160,572 across two batches), and ahead of every other individual operater or family active on Oct 6.

FortunaPrivate 4 (Oct 6, 2023): Stealer Log Summary

• Records Exposed: 8,195
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 6, 2023

Fortuna's Naming Conventions Across Seven Batches

The Fortuna family's seven Oct 6 batches use at least four distinct naming formats: numbered suffix ("FortunaPrivate 3," "FortunaPrivate 4"), sequential suffix ("FortunaPrivate1"), file-count suffix ("FortunaPrivate 265logs," "Fortuna Private 867logs"), and no suffix at all ("FortunaPrivate," "Fortuna Private"). This inconsistancy suggests either a large team using different release protocols or an operator who periodically changes naming conventions for reasons of operational security or marketplace differentation. The presence of both "FortunaPrivate" (one word) and "Fortuna Private" (two words) formats further complicates attribution.

FortunaPrivate 4 in the Oct 6 Operator Rankings

Among non-Monster Cloud Oct 6 operators, FortunaPrivate 4's 8,195 records are modest compared to the family's anchor release (FortunaPrivate 3 at 55,009). But in the broader field, 8,195 places it above SunCloudPubl 440pcs (6,697), SatanFireLogs 353pcs (6,222), SatanFireLogs 259pcs (4,612), FortunaPrivate1 (4,748), FortunaPrivate 265logs (3,174), FortunaPrivate (2,839), and prdscloud 762logs (1,698). The Oct 6 grand total now confirmed at over 786,000 exposed US credentials represents one of the most concentraded single-day credential exposure events ever documented.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records, including FortunaPrivate 4 and all seven Fortuna variants from October 6, 2023. Scan for free at HEROIC's breach scanner.