One Epic Games Password Could Unlock a Chain of Accounts

HEROIC's DarkHive intelligence platform has identified a stealer log titled Epic Games Inboxed Hits, containing 23 compromised records. Distributed through Telegram in December 2024, this dataset includes verified Epic Games account credentials — the "inboxed hits" label means these accounts have been confirmed as accessible, with the attacker having already tested email inbox access.

Plaintext Passwords Eliminate Any Safety Net

All passwords in this leak are stored as plaintext — readable at a glance with no decryption needed. For gaming accounts like Epic Games, plaintext exposure is particularly dangerous because these accounts often store payment methods, linked social accounts, and digital asset libraries worth hundreds or thousands of dollars. The passwords are ready to use the instant someone opens the file.

What Was Exposed

• Email Addresses — Accounts with verified inbox access for Epic Games
• Plaintext Passwords — Unprotected credentials for direct login
• URLs — Epic Games login endpoints and associated services

From Gaming Account to Full Digital Takeover

Attackers who compromise an Epic Games account do not stop there. They test the same credentials against email providers, payment services like PayPal, streaming platforms, and cloud storage. The "inboxed" designation in this dump is especially alarming — it means the attacker has already confirmed access to the associated email inbox, which opens the door to password resets on virtually any connected service.

How Gaming Credentials End Up in Stealer Logs

Infostealer malware thrives in gaming communities. Threats like RedLine, Vidar, and Lumma are frequently distributed through fake game cheats, cracked game downloads, and mod installers. When a gamer downloads and runs these files, the malware activates silently, extracting every password saved in their browser — including Epic Games, Steam, Discord, and email credentials. The stolen data is compiled into logs and distributed on Telegram or sold in underground marketplaces.

Check If Your Credentials Were Exposed

HEROIC provides a free breach scanner backed by over 400 billion compromised records. Search your email address to find out if your Epic Games account or any other credentials were exposed in this leak or in other known breaches. If your data is found, update your password immediately, enable two-factor authentication, and review any payment methods linked to your account.