One Telegram Upload. 27,308 Passwords. The LOGS_CENTER 12 Leak.

HEROIC analysts found a stealer log file, labeled LOGS_CENTER 12, uploaded to a public Telegram channel on July 5, 2023. The file contained 27,308 records pulled from infected devices, including email addresses, plaintext passwords, and the URLs of the accounts those credentials belong to.

One File, One Upload, 27,308 Exposed Passwords

It took a single file, uploaded to a single Telegram channel, to expose 27,308 sets of credentials. Every password inside is stored in plaintext and paired with the exact URL it unlocks, meaning an attacker can skip cracking and guessing entirely and move straight into logging into the matching accounts.

What Was Exposed in the LOGS_CENTER 12 File

• Email addresses
• Plaintext passwords
• URLs of the accounts and services accessed

Why This Matters for the 27,308 Records Involved

Credentials this exposed are exactly what attackers feed into credential stuffing tools, testing the same email and password combination across banking, email, and social media platforms. Anyone whose information appears in this log faces a real risk of account takeover, and reused passwords widen that risk into identity theft and financial fraud on other accounts too.

How a Stealer Log Like LOGS_CENTER 12 Gets Made

Stealer logs come from infostealer malware that infects a device, often through a phishing email or a malicious download, and then quietly copies saved browser passwords, autofill data, and the sites they belong to. The malware bundles everything into a log file and sends it back to the operator running it. In this case, that operator uploaded the finished log directly to a Telegram channel, giving anyone in that channel immediate access to all 27,308 records.

Check If Your Credentials Are in the LOGS_CENTER 12 Leak

If you are unsure whether your email or password ended up in this one file, checking now takes far less time than dealing with a hacked account later. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like LOGS_CENTER 12, so you know right away if a password needs to change.