Reuse Passwords? HOTS BY TORX Leak Exposed 1,623 Accounts

HOTS BY TORX Stealer Log: 1,623 Records Exposed on June 26, 2026

HEROIC analysts found a stealer log dataset labeled "HOTS BY TORX" circulating on Telegram, dated June 26, 2026. The file contains 1,623 records of stolen login data, including email addresses, plaintext passwords, and the URLs of the websites those credentials unlock.

Why the HOTS BY TORX Leak Is Dangerous

If you reuse the same password across multiple sites, a file like this one is exactly what makes that habit so risky. Each password here is stored in plaintext and already matched to the specific login URL it belongs to, so an attacker doesn't need to crack anything, they just need to try it, and if you use that same password anywhere else, they can try there too.

What Was Exposed

• Email addresses
• Plaintext passwords, stored and shared with no encryption
• URLs of the login pages tied to each stolen credential

Why This Matters

With 1,623 ready-to-use credential pairs in this file, automated tools can attempt every login in minutes. If any of those passwords were reused, on email, banking, or shopping accounts, attackers can pivot from this single leak into a much wider case of account takeover, identity theft, and financial fraud.

How Stealer Logs Work

Stealer logs are produced by infostealer malware, families such as RedLine, Raccoon, or Vidar, that infects a device through a cracked download, malicious ad, or phishing link, then quietly copies whatever is saved in the browser: usernames, passwords, cookies, and autofill data. The malware bundles this into a "log" and sends it back to whoever controls it, and logs like this one then get shared or sold on Telegram channels, exactly where HEROIC's analysts found it.

Check If You Are Affected

If you're not sure whether you reuse passwords across sites, or whether your email has shown up in a leak like this one, HEROIC's free breach scanner checks it against more than 400 billion leaked records gathered from breaches, stealer logs, and dark web dumps. The search takes seconds, and if something turns up, HEROIC shows you exactly what to change first.