Inside the 6.8 LOGS_CENTEER Breach: How 17,200 Records Were Compromised

In August 2022, a Telegram user uploading under the name "6.8 LOGS_CENTEER" released a stealer log file containing 17,200 compromised records. The data inside was in plaintext, meaning email addresses and passwords were immediately readable and usable by anyone who downloaded the file. Stealer logs of this size, dropped into public channels, represent one of the most efficient vehicles for mass credential theft that the threat landscape currently has to offer, and files from 2022 are still actively being used today.

Why This Is Dangerous

Seventeen thousand records is a substantial dataset. Each record in this log is a real person's credentials, pulled directly from their infected device and served up in a format that requires zero technical skill to exploit. The email and password combinations can be fed straight into automated credential stuffing tools that test them across hundreds of services simultaneously.

The URL data in these logs makes the attack even more targeted. Instead of guessing which services to test a given set of credentials against, attackers can look directly at the URLs captured by the stealer and know exactly where each victim was logging in. That turns a broad stuffing campaign into a precision operation, with far higher success rates than typical brute-force attempts.

What also makes this particularly concerning is the longevity of the risk. A credential that was valid in 2022 may still be valid today if the user has not changed their password. Many people only update passwords when forced to, which means a significant portion of the 17,200 records in this file could still unlock active accounts right now.

What Was Exposed

• Email addresses harvested from compromised devices
• Plaintext passwords with no hashing or encryption
• URLs tied to specific login pages and services
• API host data from cloud-connected services
• Endpoint identifiers from machines where the stealer ran
• Browser-stored credentials extracted by the malware
• Session context data linked to authenticated accounts

Why This Matters

The 6.8 LOGS_CENTEER upload is part of a broader pattern of stealer log distribution on Telegram that has been growing steadily for years. Individual drops like this one may not make headlines, but in aggregate they represent millions of compromised credentials flowing freely through underground channels on a regular basis. Each one of those credentials is a potential account takeover, a potential fraudulent transaction, or a potential foothold into a corporate network.

People often adress the immediate threat from a data breach at a company they use, but the threat from stealer logs is different because it comes from the device itself, not from a company's servers. There is no notification, no press release, and often no way for the victim to know their data is out there unless they actively check. That passive exposure is what makes stealer logs such a persistant and underestimated risk.

How Stealer Log Works

Infostealer malware gets onto devices through a wide range of delivery mechanisms, including phishing links, malicious email attachments, cracked software, fake utility downloads, and drive-by infections from compromised websites. Once it executes, it scans the system for stored credentials in browser databases, application config files, and clipboard history.

The harvested data is compiled into a structured log and exfiltrated to a remote server or dropped directly into a Telegram channel. The whole cycle from infection to posted log can occure in well under an hour. Once the file is posted, it can spread to dozens of other channels and groups within the same day.

The 6.8 naming convention on this log suggests it may be part of a larger series of uploads from the same source, which is common among prolific stealer log distributors who package and release data in batches. This kind of organized distribution makes the logs more searchable and sellable to other threat actors who want to filter by data type, country, or service.

Check If You Were Affected

If you think your email or credentials may have been part of the 6.8 LOGS_CENTEER upload or any similar stealer log leak, HEROIC's free breach checker at heroic.com lets you search your email against thousands of known breach datasets. Do not wait to find out the hard way that your account has already been taken over.