Inside Etsy Stealer Logs: 23,796 Passwords Harvested

HEROIC identified a stealer log collection specifically targeting Etsy users that surfaced on Telegram in February 2023. The dump, labeled "Etsy Target Base," contains 23,796 records with each entry including an email address, a plaintext password, and the Etsy-related URL where the credential was captured. Both buyers and sellers on the platform are potentially affected, putting shop revenue, purchase history, and linked payment methods at risk.

Why Plaintext Etsy Passwords Are Particularly Dangerous

Every one of the 23,796 passwords in this dump is stored in plaintext, requiring no technical effort to exploit. For Etsy sellers, a compromised account can mean stolen revenue, manipulated listings, or fraudulent orders placed using stored payment methods. For buyers, attackers can access purchase histories, saved addresses, and payment details. The immediate usability of plaintext passwords makes rapid response essential.

What Was Exposed

• Email Addresses — linked to Etsy buyer and seller accounts
• Plaintext Passwords — stored without encryption, ready for immediate use
• URLs — confirming Etsy as the targeted platform for credential theft

Credential Stuffing Threatens More Than Your Etsy Shop

Attackers who obtain Etsy credentials immediately test them against PayPal, bank accounts, email providers, and other e-commerce platforms. Many Etsy users link their accounts to PayPal or direct bank deposits for receiving payments, meaning a compromised Etsy password could provide a pathway to financial accounts. Credential stuffing campaigns can process all 23,796 entries against multiple platforms within hours.

How Infostealers Harvested Etsy Credentials

The Etsy-specific nature of this dump indicates the malware operator filtered stolen credentials for Etsy URLs. Infostealer malware captures every login a user performs in their browser, including saved passwords and autofill entries. When users log into Etsy on an infected device, the malware records the email, password, and URL, then transmits this data to the attacker. These Etsy-filtered logs command premium prices because of the financial value of seller accounts.

Check If Your Credentials Were Exposed

Whether you are an Etsy seller with an active shop or a buyer with saved payment information, checking your exposure is essential. HEROIC's breach scanner indexes over 400 billion compromised records and can tell you if your email or password has appeared in this Etsy-targeted dump or any other data breach. Scan now, change your Etsy password, and enable two-factor authentication to protect your account and financial information.