HEROIC Analysts Discover 11,196-Record Xavier Log 4222 Pt2

HEROIC analysts discovered a second file connected to the same operation, Xavier Group Premium Log 4222 Part 2, containing 11,196 records and uploaded to Telegram on the same day as its companion file, 28-May-2026.

Why This Is Dangerous

Finding a "Part 2" usually means there's more where that came from, a bigger operation splitting one large haul into seperate files for easier distribution or sale. Each part still carries the same risk as the whole.

What Was Exposed

• 11,196 total records
• Email Addresses
• Plaintext Password
• URLs

Why This Matters

The 11,196 people in this part of the log face the exact same exposure as anyone in Part 1, plaintext passwords sitting out in the open, ready to be tried against email, banking, or work logins. Splitting a leak into pieces doesn't make it any less real for the people caught inside it.

How Stealer Logs Work

Large stealer operations often collect so much data that a single file becomes unwieldy, so the person distributing it breaks the haul into numbered parts, like this Part 2. Underneath the packaging, the source is the same, malware running on infected devices, quietly capturing passwords and sending them back to be compiled and imediately shared.

Check If You Are Affected

Whether your data landed in Part 1 or Part 2, the fix is the same, check your exposure. HEROIC's free breach scanner searches across more than 400 billion leaked records and, beleive it or not, can show your results in mere seconds.