HEROIC Analysts Discover 933 Leaked Passwords in RAC.ca Breach

HEROIC Analysts Uncover RAC.ca Stealer Log With 933 Records

In June 2026, HEROIC's threat intelligence team identified a stealer log file circulating on Telegram that exposed 933 records tied to rac.ca. The file surfaced on 10 June 2026 and contains email addresses, plaintext passwords, and the URLs those credentials were entered on, all pulled directly from infected devices.

Why This Stealer Log Is Dangerous

Researchers note that because these passwords are stored in plaintext and linked to specific login URLs, there is no cracking or decoding required for an attacker to use them. Anyone who obtains this file can simply match the email, password, and website together and log straight into the account it belongs to.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs associated with the logins

Why This Matters

HEROIC analysts point out that plaintext passwords tied to login URLs are exactly the kind of data used in credential stuffing and account takeover attacks. If any of the 933 people in this dataset reused their password on other accounts, such as email, banking, or social media, an attacker could gain access to those as well.

How Stealer Logs Work

Analysts explain that stealer logs originate from infostealer malware, a type of malicious software that infects a device, often via a phishing link or fake download, and silently copies saved usernames, passwords, cookies, and autofill data from the browser. That harvested information is then bundled into a log file and sold or shared on Telegram channels and dark web forums, which is how the rac.ca data was found.

Check If You Are Affected

To see whether your details appear in this leak or any other, HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one. Run a free scan today to find out if your credentials need to be changed.