The MailRu Leak Puts 3.7 Million Plaintext Passwords at Risk

HEROIC analysts identified 3,766,337 records tied to MailRu, the Russian email provider, circulating on Telegram channels and dark web forums. The breach originally surfaced around September 9, 2014, and the exposed data includes email addresses and plaintext passwords. The credentials were not stolen directly from mail.ru's own systems, but were confirmed to be valid logins that affected users had reused on other services.

Why 3.7 Million Plaintext Passwords Is a Serious Problem

Plaintext means these passwords require no cracking at all, they're readable the instant someone opens the file. At a scale of nearly 3.8 million accounts, even a modest reuse rate translates into hundreds of thousands of working logins an attacker could try elsewhere.

What Was Exposed in the MailRu Leak

• Email addresses
• Passwords (plaintext)

Why This Matters for MailRu Users

Because these credentials were confirmed to work on services beyond mail.ru itself, this dataset is especially attractive for credential stuffing, where attackers systematically test stolen email and password pairs against banking sites, e-commerce platforms, and social media. A plaintext password reused anywhere else is effectively an open door.

How a Database Breach Like This Happens

This incident is classified as a database breach. Rather than a direct hack of mail.ru's systems, large combined lists like this one are often assembled from smaller breaches across many different sites, then organized by email domain, which is why so many mail.ru addresses ended up grouped together in one dump.

Check If You Are Affected by the MailRu Leak

If you have a mail.ru email address, it's worth checking whether it appears in this leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including this one, so you can find out quickly and change any passwords you may still be reusing.