For Nearly 3 Years, 19,577 Outlook Logins Sat Exposed Online

A file called 20k outlook uploaded by a Telegram User has been floating around low-level trading channels since 21 August 2023, and it only recently made its way into a verified tracking database. It carries 19,577 records, mostly Outlook addresses paired with the plaintext password used to unlock them.

Why This Is Dangerous

What makes stealer logs different from a typical corporate breach is that nobody had to hack a server to get this data. A person's own device gave it up, one saved password at a time, and now anyone holding the file can log straight into whatever account each line points to. There is no puzzle to solve, no encryption to crack, just usernames and passwords ready to paste into a login screen.

What Was Exposed

• Roughly 19,577 separate login records tied to Outlook accounts
• Plaintext passwords stored with zero protection
• Web addresses showing which sites each set of credentials belongs to

Why This Matters

Almost three years is a long time for a leak to sit around before the people inside it ever hear about it. In that stretch, a password can get tried against dozens of other services, wich means the damage from a single stealer log can spread far past the original Outlook account it occured on.

How This Kind of Leak Actually Happens

A stealer log usually starts with one infected computer, often after someone installs a cracked program, opens a booby-trapped attachment, or clicks a fake software update. The malware then reads through saved browser data, session tokens, and autofill fields, quietly copying anything that looks like a login. It ships everything back to an operator, who bundles the results into a file exactly like the one carrying the Outlook name and offers it up on Telegram or hacking forums.

Check If You Are Affected

HEROIC's scanner is built to search across more than 400 billion (400B+) leaked records, this one included, and it takes only your email address to check. Given how long this particular file has been circulating, running a quick scan now is a smarter bet than assuming it doesn't apply to you. If your Outlook address is in there, change the password immediately and turn on two factor authentication before doing anything else.