How Malware Led to 70,220 Stolen Logins in the Italy Dump

HEROIC's dark web monitoring operations uncovered a stealer log collection labeled 100k Italy circulating on Telegram. First appearing in February 2023, this geographically targeted dataset contains 70,220 records stolen from Italian users' devices by infostealer malware, exposing email addresses, plaintext passwords, and the URLs of websites and services where victims entered their credentials.

Plaintext Passwords Put Italian Users at Immediate Risk

Every password in this 70,220-record dump is stored in plaintext—readable at a glance with no decryption required. Italian users whose credentials appear in this collection face immediate exposure. Their login details can be used the moment an attacker downloads the file, with no computational barriers or time delay. This makes the window for protective action extremely narrow once the data begins circulating.

What Was Exposed

• Email Addresses — Italian personal and business email accounts used for online services
• Plaintext Passwords — unencrypted credentials captured directly from browser storage
• URLs — Italian and international websites including banking, government services, and e-commerce platforms

Credential Stuffing Crosses Borders and Services

Although this collection targets Italian users, the credential stuffing threat extends globally. Attackers test these 70,220 email-password combinations against international platforms—Amazon, PayPal, Google, Microsoft, and more. Italian users who reuse their local banking password on international shopping sites or social media platforms create a path for attackers to move from a regional leak to worldwide account compromise.

The Malware Behind the Italy Collection

This dataset was built from infostealer malware infections targeting Italian users. The malware—typically strains like Vidar, RedLine, or Lumma—reached victims through Italian-language phishing campaigns, malicious downloads from compromised websites, and trojanized software. Once running on a device, the malware harvested all browser-saved credentials, session cookies, and autofill data. Individual victims' log files were then aggregated by geography and packaged into this Italy-focused collection for distribution on Telegram.

Check If Your Credentials Were Exposed

HEROIC's breach intelligence platform contains over 400 billion records from data breaches, stealer logs, and dark web leaks around the world. Use HEROIC's free breach scanner to check if your email address or credentials appear in the 100k Italy dump or any other known breach. If a match is found, change the compromised password on all services where you used it, switch to unique passwords for each account, and enable two-factor authentication immediately.