How Malware Led to 121,104 Stolen Logins From T-Online.de

HEROIC's DarkHive intelligence platform has uncovered a massive stealer log targeting T-Online.de users, exposing 121,104 compromised records. Distributed on Telegram in December 2024, this dataset contains credentials belonging to users of Germany's largest email and internet provider, Deutsche Telekom's T-Online service. Each record was extracted by infostealer malware from an infected device.

Readable Passwords Mean Immediate Exploitation

All 121,104 passwords in this dataset are stored as plaintext — completely unprotected and readable by anyone. For a breach of this scale targeting a major German ISP, the implications are severe. Attackers can immediately begin logging into T-Online email accounts, accessing private correspondence, intercepting password reset emails from other services, and using these accounts as launchpads for further attacks.

What Was Exposed

• Email Addresses — T-Online.de accounts belonging to German internet users
• Plaintext Passwords — Unencrypted credentials ready for immediate use
• URLs — Login portals and websites where these credentials were captured

Credential Stuffing at Scale

With over 121,000 email-password pairs, this dump provides attackers with enormous firepower for credential stuffing campaigns. Automated tools will test these T-Online credentials against German banking platforms like Sparkasse and Commerzbank, shopping sites like Amazon.de and Otto, government portals, and insurance providers. Given the scale, even a modest rate of password reuse among victims could yield thousands of additional compromised accounts.

The Infostealer Epidemic Targeting European Users

European users have become a prime target for infostealer malware campaigns. Threats like Raccoon, RedLine, and Vidar are distributed through German-language phishing emails impersonating DHL, Deutsche Post, and government agencies. When victims click malicious links or open infected attachments, the malware installs silently and begins extracting passwords from every browser on the device. The stolen data is sorted by email domain, packaged into logs, and shared on Telegram — which is how this T-Online.de dataset surfaced.

Check If Your Credentials Were Exposed

HEROIC's free breach scanner indexes over 400 billion compromised records. German T-Online users and anyone else concerned about their online security can search their email address to determine if their credentials appeared in this leak or any other known breach. If your data is found, change your T-Online password immediately and enable two-factor authentication across all your accounts.