54,976 JohnDoeProject Logins Leaked in Telegram Stealer Log

HEROIC found: On February 17, 2025, a Telegram user uploaded a stealer log through JohnDoeProject, exposing 54,976 records containing email addresses, plaintext passwords, and URLs from compromised endpoints and services.

Why the JohnDoeProject Breach Is Dangerous

Stealer logs like the JohnDoeProject dataset give attackers a ready-made list of working logins. Unlike breaches where passwords are hashed and must be cracked, this log delivers 54,976 email and plaintext password pairs directly usable for account takeover without any additional processing.

What Was Exposed in the JohnDoeProject Leak

• Email addresses
• Plaintext passwords
• URLs associated with compromised accounts and services

Why This JohnDoeProject Data Puts You at Risk

Credential stuffing tools can test thousands of login combinations per minute. The 54,976 logins in the JohnDoeProject dataset are immediately fed into these automated systems, targeting banking platforms, webmail providers, and corporate login portals. Any account where you reused an exposed password is at immediate risk.

How Stealer Logs Work

Infostealer malware is designed to harvest credentials silently from compromised endpoints. It captures passwords entered into browsers, reads saved credentials from password managers, and extracts session cookies. The complete harvest is transmitted to attacker infrastructure and packaged into log files that are posted to Telegram for rapid criminal distribution.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the JohnDoeProject leak or thousands of other breaches in our database.