GHOST FREE 10 Leak Makes Identity Theft Easier for 41,686 People

HEROIC analysts identified a stealer log dump called GHOST FREE 10, uploaded to a Telegram channel on October 17, 2025. The file contains 41,686 records, each one pairing an email address, a plaintext password, and the URL of the account the login unlocks. It is a smaller file compared to some of the mega leaks out there, but for the 41,686 people whose information is inside, identity theft just became a whole lot easier.

Why the GHOST FREE 10 Leak Raises the Identity Theft Risk

Identity theft usually requires an attacker to piece together several bits of personal information before they can convincingly impersonate someone. A leak like GHOST FREE 10 skips several of those steps by handing over a working email address and password together. From an email inbox, an attacker can often find billing addresses, account numbers, and answers to security questions, everything needed to open new accounts or reset passwords elsewhere in the victim's name.

What Was Exposed in the GHOST FREE 10 Dump

• Email addresses tied to real accounts
• Plaintext passwords with no encryption protecting them
• URLs revealing which specific site or service each login belongs to

The confirmed count sits at 41,686 records, all reportedly connected to users in the United States.

Why This Matters Beyond a Single Password

Once an attacker recieves working login details, credential stuffing tools take over, testing the same email and password across dozens of other popular sites. If the victim reused that password anywhere else, account takeover happens fast, and identity theft often follows soon after. Financial fraud, fake accounts opened in someone's name, and drained loyalty or rewards balances are all common results once a credential pair like this starts circulating.

How a Stealer Log Like GHOST FREE 10 Gets Made

Stealer logs are the product of infostealer malware, a category of malicious software that infects a device through pirated downloads, fake cracks, or phishing emails. Once active, it silently scrapes saved passwords, autofill fields, and browsing data straight out of the browser, then ships everything to the attacker in a single file. That file then gets uploaded to Telegram channels or dark web forums under a name like GHOST FREE 10, ready to be sold, traded, or used directly against the victims inside it.

Check If You Are Affected

If your email address or an old password shows up in the GHOST FREE 10 dump, the risk of identity theft is not hypothetical, it is immediate. HEROIC's free breach scanner checks your details against a database of more than 400 billion leaked records and tells you in seconds whether you are exposed. Run a free scan today and lock down any account before someone else gets there first.