14,284 Passwords Exposed: Inside the Obsidian Project Leak

Fourteen thousand two hundred eighty four people have passwords sitting in a public Telegram file right now, and most of them have no idea. The file is called Obsidian Project, uploaded June 1, 2026, and it holds exactly 14,284 stolen login records.

Why This Is Dangerous

Names like Obsidian Project sound almost mysterious, like something out of a spy movie, but there's nothing dramatic about what's inside. It's just a spreadsheet of stolen credentials, and the danger comes from how usable it is. No decryption, no special software, just an email and a password anyone can copy and paste. The breach occured quietly, without any warning to the people affected.

What Was Exposed

• Email addresses tied to individual accounts
• Passwords left in plain, unprotected text
• URLs marking where each set of credentials was used

Why This Matters

The people behind Obsidian Project didn't target one company, they targeted whoever's computer happened to get infected. That means the accounts inside this file span email providers, retail sites, and who knows what else, and most people don't relize their password has been sitting exposed until it's already too late.

How Stealer Logs Work

A project-style name like this often signals an organized operation rather than a one-off dump. Malware infiltrates a device, quietly reads through the browser's stored logins and session cookies, and sends everything to a central collector. From there it gets branded, sometimes with a name meant to sound impressive, and distributed to buyers or dumped for free to build a reputation on Telegram.

Check If You Are Affected

Rather than hoping your email isn't in the Obsidian Project file, just check it. HEROIC's free scanner searches more than 400 billion compromised records in one pass, and if your information does turn up, you'll know exactly which accounts need new passwords rite away.