JohnDoeProject Data Leak: Emails and Plaintext Passwords Exposed

HEROIC found: On January 29, 2025, a Telegram user uploaded a stealer log through JohnDoeProject, exposing 33,799 records containing email addresses, plaintext passwords, and URLs from compromised endpoints and services.

Why the JohnDoeProject Breach Is Dangerous

JohnDoeProject stealer logs contain 33,799 complete credential sets harvested from infected endpoints. The inclusion of plaintext passwords means attackers bypass encryption entirely. Each stolen email-password pair is an actionable login credential that can be used immediately against any service where the victim has an account.

What Was Exposed in the JohnDoeProject Leak

• Email addresses
• Plaintext passwords
• URLs associated with compromised accounts and services

Why This JohnDoeProject Data Puts You at Risk

With 33,799 exposed credentials, attackers have a large pool to work with in automated credential stuffing campaigns. These attacks cycle through financial platforms, corporate email systems, and consumer services in seconds. Even if only a small fraction of credentials succeed, attackers gain valuable footholds into accounts containing personal data, payment information, and connected applications.

How Stealer Logs Work

Infostealer malware is commonly delivered through phishing emails, pirated software, or malvertising. After infection, it scans the device for saved passwords in browsers, copies session cookies to bypass two-factor authentication, and harvests autofill data. The complete dataset is packaged into logs and uploaded to Telegram, where criminals access it for credential stuffing and account takeover attacks.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the JohnDoeProject leak or thousands of other breaches in our database.