Identity Theft Risk Grows After Grom.Free.Logs Exposes 5,921 Passwords

Identity Theft Risk Grows After the Grom.Free.Logs Stealer Log Surfaces

On December 12, 2022, a Telegram user posting under the name "Grom.Free.Logs" uploaded a stealer log file to a public channel. HEROIC analysts identified it during routine monitoring of dark web and Telegram activity. The file contained 5,921 records, each pairing an email address with a plaintext password and the URL of the API host the credentials belonged to.

Why This Is Dangerous

Because the passwords in this log are stored in plaintext, there is no encryption standing between an attacker and the account. Pairing each password with the exact API host URL it unlocks makes the data immediately usable, turning a list of stolen credentials into a direct path toward identity theft and account takeover for anyone whose information appears in the file.

What Was Exposed

• Email addresses
• Plaintext passwords
• API host URLs

Why This Matters

Stolen email and password pairs like these are the raw material for credential stuffing attacks, where automated tools try the same login across banking sites, email providers, and shopping accounts. Because so many people reuse passwords, one exposed login can lead to several compromised accounts. From there, identity theft becomes far easier: an attacker with access to a victim's email can reset passwords elsewhere, open new accounts in their name, or drain funds directly.

How Stealer Logs Work

A stealer log is produced by information-stealing malware that runs quietly on an infected device, capturing login credentials as the victim types them. Rather than breaching a company's servers, this malware harvests data directly from the user's browser or apps, often after they install a fake download or pirated software. The captured records, including the API host URLs tied to each login, are then packaged into a log file and shared or sold, in this case uploaded to a public Telegram channel.

Check If You Are Affected

If you want to know whether your email address or passwords have appeared in this stealer log or any other breach, HEROIC's free breach scanner checks your details against a database of more than 400 billion leaked records. A scan takes just a few seconds and can tell you whether it's time to change a password.