The giftcards.com Stealer Log Exposed 420 Shopper Accounts

HEROIC analysts identified a stealer log dataset filtered to giftcards.com login credentials, that a Telegram user uploaded on 16-Jul-2026. The file contains 420 records pulled from infected devices, including email addresses, plaintext passwords, and the login page URLs tied to those accounts. This is not a breach of the giftcards.com platform itself, it is a set of account credentials stolen from infected devices.

Why This Is Dangerous

Accounts on gift card platforms often carry stored balances, saved cards, or purchase history that can be resold or drained quickly. Each of these 420 records pairs a working email address and plaintext password with the exact login page it opens, so an attacker can walk straight into an account without cracking anything.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

A file of 420 records is small in scale, but every account in it faces a real risk of being drained or hijacked before the owner notices. If any of these passwords are reused elsewhere, attackers can use them for credential stuffing, account takeover, and in more serious cases financial fraud or identity theft.

How Stealer Logs Work

Stealer log malware infects a device, often through a fake download, cracked software, or a malicious attachment, and quietly copies saved browser passwords, autofill data, and session details. Some stealer tools let attackers sort the stolen data by the website it belongs to, which is how a batch specifically tied to giftcards.com ends up packaged as its own file and shared through channels like Telegram.

Check If You Are Affected

If you want to know whether your information appears in this giftcards.com file or any other breach, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a scan now and change any password that may have been exposed.