637,617 Records Exposed by Dec 2024 OpenBullet Anomaly Leak

On December 30, 2024, a stealer log file named "OpenBullet Anomaly 1.4" appeared on Telegram, exposing 637,617 records of email addresses, plaintext passwords, and the login URLs tied to each one.

The Countdown to the OpenBullet Anomaly 1.4 Leak

By late December 2024, infected devices around the world had already been quietly leaking saved passwords for weeks through infostealer malware. On December 30, that accumulated data was packaged into a single file and uploaded to Telegram under the name OpenBullet Anomaly 1.4, a name that nods to OpenBullet, a tool widely used by criminals to automate credential stuffing attacks. Once the file went live, the clock started on how quickly its 637,617 records could be put to use against other accounts.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

All 637,617 records were plaintext, meaning no encryption stood between the data and anyone who obtained the file.

Why This Matters

A log this size, especially one named after a credential stuffing tool, is built for exactly that purpose: testing stolen email and password pairs against banking, email, and retail sites in bulk. If your credentials were reused anywhere else, this is the moment they become a doorway to account takeover, identity theft, or direct financial fraud.

How OpenBullet-Style Attacks Unfold

Stealer malware harvests saved logins from an infected browser and ships them back to an attacker. From there, tools like OpenBullet load the stolen list and automatically test each email and password combination against hundreds of websites in minutes, flagging every account where the login works. That is what makes logs branded with tool names like this one particularly fast-moving once they're released.

Check If You Were Caught in This Leak

With 637,617 records involved, waiting to find out isn't a good strategy. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including the OpenBullet Anomaly 1.4 log, so you can see your exposure right now and change any reused passwords before they're tested against your other accounts.