HEROIC Analysts Flag InfernoLogsCloud Leak of 18,104,615 Records

HEROIC analysts flagged another entry in the InfernoLogsCloud series this week, and this one is bigger than most. Labeled FREE195, the file was uploaded to Telegram in October 2025 and contains 18,104,615 records, each pairing an email address with a plaintext password and the URL it was stolen from.

Why This Is Dangerous

When researchers look at a file this large, the aparent scale is only part of the concern. Eighteen million records means eighteen million opportunities for account takeover, credential stuffing, or straight up identity theft, all without an attacker needing any special skill beyond knowing how to open a text file.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs linking each credential to its source site
• 18,104,615 total records exposed

Why This Matters

Analysts note that files like this rarely get any public acknowlegement from the services whose users are affected, since the data comes from infected devices rather than a breached company. That means most victims will never recieve an official notification telling them their credentials were exposed, they simply have to find out for themselves.

How Stealer Logs Work

Every record in a file like FREE195 traces back to the same basic process, stealer malware infects a device, quietly copies whatever passwords and cookies are saved in the browser, and reports back to whoever is running the operation. Multiply that across millions of infections and the operator ends up with a log big enough to hit eighteen million records in a single Telegram post.

Check If You Are Affected

You don't have to wait for HEROIC analysts to name your account specifically to take action. Our free breach scanner checks your email against more than 400 billion leaked records, including logs like this one, so you can see your exposure in seconds and reset any password that comes back compromised.