How the 16.3KK BIG USA MIX BASE Stealer Log Reached Telegram

HEROIC analysts traced how a dataset called "16.3KK BIG USA MIX BASE" ended up circulating on a Telegram channel, with the underlying data dated April 2, 2023. The file contains 14,702,298 records, making it one of the largest stealer logs HEROIC has processed in this batch, each entry pairing an email address with a plaintext password and the URL where that credential was used.

Why the USA Mix Base Leak Is Dangerous

A file of nearly 14.7 million plaintext credentials is not the product of one hack, it's the accumulated output of countless individual malware infections stitched together into a single "mix base." That scale means attackers can run automated login attempts against a huge range of sites at once, using each record's paired URL to know exactly where to try it.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs tied to each credential

Why This Matters

At this scale, credential stuffing becomes almost a certainty rather than a possibility, some percentage of the 14,702,298 accounts in this file will share a password with a bank, an email provider, or a shopping account. That overlap is exactly what turns a stolen streaming or forum password into full-blown account takeover or financial fraud.

How Stealer Logs Work

Here's how a base like this typically comes together: stealer malware, often disguised as cracked software or a game cheat, infects thousands of individual computers over time. Each infected device quietly hands over its saved browser passwords and visited URLs. Rather than selling each small log separately, operators combine dozens or hundreds of individual infections into one "mix base," labeled with a rough record count like "16.3KK" (16.3 million), and release it as a single, more marketable product. The final verified count in this case came to 14,702,298 records.

Check If You Are Affected

Given the size of this leak, checking your exposure directly is far safer than assuming you're not affected. HEROIC's free breach scanner searches more than 400 billion breached records, this dataset included, so you can find out in seconds and secure any accounts that share a password with what was exposed.