Fresh 2.7KK Domain USA ATT Stealer Leak Exposes 2.39M Records

HEROIC analysts catalogued a dataset named "fresh 2.7KK Domain USA ATT" after it was uploaded to a Telegram channel, with the underlying data dated April 2, 2023. The file contains 2,393,240 records, each pairing an email address with a plaintext password and the URL of the login page it came from. The "ATT" and "USA" naming suggests the seller marketed this batch as US-based credentials tied to specific domains, though the scale alone, nearly 2.4 million records, makes it one of the larger stealer logs HEROIC has processed from this source.

Why This Leak Is Dangerous

With millions of plaintext email and password pairs in one file, attackers can automate login attempts at massive scale using simple scripts. Because each credential is linked to the exact URL it was captured from, there's no wasted effort, every record is a working combination for a specific site rather than a blind guess.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs tied to each credential

Why This Matters

A leak of this size dramatically raises the odds that credential stuffing attacks will succeed against at least some portion of the 2,393,240 accounts involved, especially anyone who reused a password across multiple sites. The fallout can range from a single hijacked email inbox to broader account takeover and financial fraud across banking, retail, and subscription services.

How Stealer Logs Work

This file is a stealer log, meaning the data was harvested by malware installed on victims' own devices rather than stolen from a single company's servers. Stealer malware is commonly spread through cracked software, fake game cheats, or malicious downloads, and once active it copies every saved password, autofill entry, and visited login URL from the browser. Large "domain-based" logs like this one are often assembled by combining many individual infections into one file before being sold or shared under a catchy name to attract buyers.

Check If You Are Affected

With millions of records in this one file alone, the safest move is to search for yourself rather than assume you're not included. HEROIC's free breach scanner checks your email against more than 400 billion breached records, this leak among them, so you can find out in seconds and lock down any accounts that need it.