Inside the 14.8 LOGS_CENTEER Breach: How 14,577 Records Were Compromised

In August 2022, a stealer log file known as "14.8 LOGS_CENTEER" was uploaded to a public Telegram channel by an anonymous user. The file contained 14,577 records, each one a set of credentials captured from an infected device. These were not hashed or obscured in any way, meaning the email addresses, passwords, and associated URLs were all sitting in plaintext for anyone who downloaded the file to use immediately.

Why This Is Dangerous

When passwords are stored in plaintext in a stealer log, there is no buffer between the attacker and the victim's accounts. Unlike database breaches where attackers still need to crack hashed passwords, a stealer log is instantly usable. The moment someone downloads this file, they have 14,577 working credential sets ready to test across email providers, banking apps, social media platforms, and anything else where people tend to reuse passwords.

The addition of associated URLs in the dataset makes the threat more targeted. An attacker does not need to guess which services the victim uses, the URLs tell them directly. That information alone makes it much easier to run focused attacks rather than broad credential stuffing sweeps.

Stealer logs like this one also tend to persist. Even though this file was uploaded in August 2022, it may have been copied and re-shared many times since. Anyone who had an infected device around that time and has not changed their passwords since could still be at risk from the same leak years later.

What Was Exposed

• Email addresses
• Plaintext passwords
• Website and service login URLs
• API host endpoint addresses
• Browser-saved credential pairs
• Endpoint session identifiers
• Account-specific access strings tied to particular services

Why This Matters

The "LOGS_CENTEER" naming pattern, combined with the "14.8" label, strongly suggests this is one file in a numbered series of stealer log releases. This kind of organized, numbered distribution points to a deliberate operation where logs are regularly collected and published in batches, which means the people behind it are not acting impulsively but working through a pipeline of compromised data.

For individuals affected by this particular upload, the concern extends beyond their own accounts. If any of these credentials belonged to employees, the damage could spread into corporate networks, project management tools, or cloud infrastructure. A single set of exposed work credentials can sometimes be all that is needed to gain a foothold inside an organization.

How Stealer Log Works

Infostealer malware is the starting point for every stealer log breach. The malware typically finds its way onto a device through a convincing phishing email, a cracked software download, or a browser extension that turns out to be malicious. Once installed, it begins scanning the device silently, looking for anything saved in the browser including passwords, cookies, credit card autofill data, and more.

Everything it finds gets compiled into a log and sent back to the attacker's server. This transmission occured in the background, often completing in just a few minutes, long before the user has any reason to suspect something is wrong. The attacker then reviews the logs, extracts anything particularly valuable, and either uses the rest directly or publishes it to forums and Telegram channels.

The scale of this particular release, 14,577 records across endpoints in the United States, suggests the malware was distributed broadly, likely through a campaign rather than a single targeted attack. Broad distribution campaigns tend to rely on phishing or fake software installers designed to look legit and recieve high download volumes.

Check If You Were Affected

If you had any device that may have been infected with malware around August 2022, or if you beleive your credentials could be in the 14.8 LOGS_CENTEER dataset, check your exposure now using HEROIC's free breach checker at heroic.com. Search your email adress to find out whether your information has shown up in known breach records.