gmx.de Breach Hits German Email Users: 10,788 Passwords Leaked

In June 2026, HEROIC analysts discovered a stealer log specifically targeting users of gmx.de, one of Germany's largest and most widely used email providers. The file appeared on a public Telegram channel and contained 10,788 records with email addresses, plaintext passwords, and browsing URLs taken from infected devices. The data was verified and indexed in the HEROIC breach database on July 15, 2026.

Why German Email Users Are at Particular Risk

GMX is a cornerstone of personal and business email in Germany, with millions of active accounts. The 10,788 exposed credentials in this stealer log represent a concentrated threat to German internet users. Because gmx.de accounts are often linked to German banking portals, government services, and online retailers, attackers with these plaintext passwords can attempt to access high-value accounts specific to the German market. The browsing URLs in each record reveal exactly which regional services each victim relies on.

What Was Exposed in This Stealer Log

• Email addresses from gmx.de, a dominant German email provider
• Plaintext passwords in fully readable form, ready for immediate misuse
• Browsing URLs identifying which German and international sites each user visited

Why These Credentials Fuel Credential Stuffing Across German Services

Attackers know that German users frequently link their gmx.de email to services like online banking, health insurance portals, and tax filing platforms. When they obtain a plaintext password from this stealer log, automated tools test it against dozens of German-language services within seconds. Password reuse means that many of these attempts succeed, giving criminals access to financial accounts, personal documents, and sensitive communications. The scale of 10,788 exposed records makes this a significant threat to the German digital ecosystem.

How Stealer Logs Target Regional Email Providers

Stealer logs are created by infostealer malware that runs silently on compromised devices. This malware spreads through phishing campaigns, trojanized software downloads, and malicious links on social media. It captures login credentials stored in browsers, records typed passwords, and logs every website the victim visits. Attackers often sort and label the resulting data by email domain, which is why this log specifically targets gmx.de users. The organized data is then shared or sold on Telegram and dark web forums.

Check If Your gmx.de Account Was Compromised

If you use a gmx.de email address, your credentials may be among the 10,788 records in this stealer log. HEROIC maintains a database of over 400 billion compromised records from breaches, stealer logs, and dark web sources across the globe. Use HEROIC's free breach scanner to search your email address and find out if your account data has been exposed in this breach or any other incident.