One Stealer Log. 26,404 Records. The 37.com Leak Credentials.

HEROIC analysts identified this stealer log on 10-Jun-2026. The breach exposed 26,404 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as 37.com, uploaded by a Telegram user.

Why This Is Dangerous

This stealer log captured over 26,000 email credentials from 37.com, a gaming and entertainment platform. Users who registered on 37.com with the same email and password they use elsewhere are at particular risk. Credentials stolen from gaming accounts are frequently used to compromise email providers, payment accounts, and other platforms linked to the same login.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs (website addresses where each credential was used)

Why This Matters

The 37.com credential leak matters because gaming platform users often reuse passwords across services. When 26,404 plaintext passwords are made publicly available, criminals can test each one against email providers, banking apps, and social media platforms. Even if your 37.com account itself holds no sensitive data, the same password used elsewhere can give attackers access to accounts that do, leading to identity theft and financial fraud.

How a Stealer Log Works

A stealer log is produced when malware installed on a device captures the browser's saved login data. The malware records the website address, the username, and the password for every site the user has saved credentials for. This data is packaged and uploaded to dark web markets and private Telegram channels, where it is freely downloaded and used by criminals.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.