The NIGHT SORTED Dump: 3,036 Stolen Login Credentials Hit the Dark Web

In May 2023, a Telegram user distributed a stealer log known as NIGHT SORTED, containing 3,036 stolen records assembled from compromised devices. The dump included email adresses, plaintext passwords, and URLs -- a combination that gives anyone in possession of the file an immediate, actionable attack surface. Unlike traditional database breaches, stealer log dumps require no decryption, no cracking, and no additional preperation. The credentials are ready to use the moment the file is downloaded.

Why This Is Dangerous

NIGHT SORTED is a "sorted" stealer log, meaning the data has been organized and cleaned for ease of use. Sorted logs are more dangerous than raw dumps because the work of filtering and verifying credentials has already been done. Whoever packaged this file curated it for maximum usability -- making it an efficient tool for credential stuffing attacks, account takeovers, and identity fraud. The plaintext passwords in this file require zero technical skill to exploit.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (a record of which sites and services each victim accessed)

Why This Matters

Three thousand and thirty-six stolen credentials represent 3,036 real people who have no idea their passwords are circulating on the dark web. Sorted stealer logs like NIGHT SORTED are particulary prized by cybercriminals because the cleanup work is done -- each entry is a usable credential pair, not raw noise. For victims, the consequences range from hijacked email accounts to drained bank accounts to fraudulent loan applications. The damage can take months or years to fully untangle.

How Stealer Logs Work

Stealer malware arrives through phishing campaigns, bundled with cracked software, or embedded in fake browser extensions. Once active on a device, it runs invisibly, capturing every password stored in the browser, every URL visited, and every credential entered into a login form. The data is exfiltrated to the attacker and then organized into log files for distribution. NIGHT SORTED was assembled from this process and uploaded to Telegram in May 2023, where it was made avaialble to thousands of subscribers in underground channels.

Check If You Are Affected

HEROIC's free scanner searches more than 400 billion exposed records -- including sorted stealer logs like NIGHT SORTED. Enter your email address and find out instantly whether your credentials have been compromised. If they appear in this or any other breach, you will know immediately so you can change your passwords and secure your accounts before the damage is done.