87,035 Stolen Logins From JohnDoeProject Found on Telegram

HEROIC found: On March 11, 2025, a Telegram user uploaded a stealer log through JohnDoeProject, exposing 87,035 records containing email addresses, plaintext passwords, and URLs from compromised endpoints and services.

Why the JohnDoeProject Breach Is Dangerous

Finding 87,035 stolen logins on Telegram means a large criminal audience had immediate access to active credentials. The JohnDoeProject stealer log was available to every member of the Telegram channel where it was posted, multiplying the number of attackers who could deploy these credentials in unauthorized access attempts against banking, email, and social media platforms.

What Was Exposed in the JohnDoeProject Leak

• Email addresses
• Plaintext passwords
• URLs associated with compromised accounts and services

Why This JohnDoeProject Data Puts You at Risk

With 87,035 plaintext credentials publicly posted on Telegram, the scale of potential exploitation is significant. Automated tools test each login pair against dozens of platforms simultaneously. Any account where your JohnDoeProject credentials were also used faces ongoing risk until those passwords are changed and sessions are revoked.

How Stealer Logs Work

Infostealer malware infects endpoints through phishing, drive-by downloads, or software vulnerabilities. It harvests every saved password and active session cookie from the device before transmitting the data to attacker-controlled infrastructure. The compiled log files are then posted to Telegram channels, where large audiences of criminals download and exploit them immediately.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the JohnDoeProject leak or thousands of other breaches in our database.