FR 8.18 Leak Means 357,372 Accounts Are Ready to Steal

HEROIC uncovered a massive stealer log file labeled "FR 8.18" shared on Telegram in February 2023. The dump contains 357,372 records, with the "FR" prefix suggesting a focus on French internet users. Each record pairs an email address with a plaintext password and the URL of the service where the credential was captured, giving attackers a comprehensive toolkit for large-scale account compromise.

Over 357,000 Passwords With Zero Protection

Every password in this enormous collection appears in unencrypted plaintext. At this volume, even automated tools can work through the entire dataset quickly, testing each credential against target services. The sheer number of exposed passwords means that even with low individual success rates, thousands of accounts will be vulnerable to immediate takeover without any password cracking effort required.

What Was Exposed

• Email Addresses — hundreds of thousands of accounts, many from French domains
• Plaintext Passwords — completely unprotected and exploitable on download
• URLs — mapping out which French and international services were compromised

A Treasure Trove for Credential Stuffing Operations

A dataset of 357,372 credentials is a premium resource for credential stuffing operations. Attackers feed these email-password combinations into automated tools that test them against banking portals, government services, telecommunications providers, and retail platforms. French users who reuse passwords across La Poste, Orange, SFR, and other local services are especially vulnerable to cascading compromise from a single exposed credential in this dump.

Stealer Malware: The Silent Data Collector

This collection was assembled by infostealer malware running undetected on infected devices. These programs embed themselves in the operating system, extracting credentials from browser password managers, capturing login form submissions in real time, and harvesting session cookies. The geographic concentration suggested by the "FR" label indicates the malware campaign may have specifically targeted French-language websites, phishing lures, or software repositories popular with French users.

Check If Your Credentials Were Exposed

With over 357,000 records in this single dump, the probability of individual exposure is substantial for anyone who uses French online services. HEROIC's breach scanner indexes more than 400 billion compromised records and can determine whether your email or password appears in this or any other known data breach. Scan your credentials now and take immediate action to change any passwords that have been compromised.