The JohnDoeProject Leak: 78,790 Passwords Exposed. Yours Might Be One.

HEROIC analysts identified this breach while monitoring Telegram channels that distribute stolen credential packages. In August 2025, an anonymous Telegram user uploaded a stealer log file labeled JohnDoeProject, exposing 78,790 records taken from compromised endpoints. The file contained email addresses, plaintext passwords, and URLs including API hostnames, all gathered without the victims' knowledge by credential-stealing malware. The breach was confirmed on August 31, 2025. With nearly 79,000 records in a single file, this dump is large enough to affect a meaningful number of real people who may have no idea their credentials are sitting on Telegram right now.

Why This Is Dangerous

Plaintext passwords are the worst possible outcome in a credential breach. There is no barrier between this file and a working login. Whoever downloaded the JohnDoeProject file from Telegram can walk directly into any account where the exposed password was reused. Email, banking, cloud storage, work accounts, subscription services. Stealer logs capture everything the infected browser had saved, which means victims are often exposed across many sites at once. The API hostnames included in this file also point to potential corporate targets, raising the stakes beyond personal account takeover.

What Was Exposed

• 78,790 records from devices infected with stealer malware
• Email addresses serving as account usernames
• Plaintext passwords with zero encryption
• Endpoint URLs and API hostnames from compromised systems
• Data uploaded to Telegram on August 31, 2025

Why This Matters

Nearly 79,000 people had their credentials stolen and posted publicly without ever knowing it happened. The JohnDoeProject label gives no hint about who the real victims are or where the data came from. That ambiguity is deliberate. Attackers bundle stealer log output under vague names precisely because it makes tracking harder. What is not ambiguous is the risk. Every person in this file is now a target for account takeover, phishing, and credential stuffing attacks across every site where they reused that password. The longer they go without knowing, the more damage can occcur.

How Stealer Malware Harvests Your Passwords

Stealer malware infects a device through a malicious download, a phishing link, or a compromised software installer. Once running, it silently reads every password saved in your browser, copies your session cookies, records recently visited URLs, and grabs any autofilled credentials. It bundles all of this into a log file and sends it to the attacker within minutes. The victim's computer keeps working normaly. Nothing looks wrong. The attacker now has a complete snapshot of every saved login on that device, ready to package and sell or upload to Telegram. This is how 78,790 records end up in a single file called JohnDoeProject.

Check If You Are Affected

Your password may be in this file right now and you would have no way of knowing without checking. HEROIC's free breach scanner searches across more than 400 billion exposed records, including stealer log dumps like JohnDoeProject. Enter your email address and find out in seconds whether you are exposed. If you are, change the affected passwords immediately and enable two-factor authentication on every account that supports it. Do not wait. The people who downloaded this file are already acting on it.