Protonmail.co.uk Stealer Log Leak: 6,921 Records Exposed

On June 21, 2026, HEROIC analysts logged a stealer log file uploaded to Telegram containing exactly 6,921 records tied to protonmail.co.uk accounts. The number is precise, not rounded, because each record represents one set of harvested credentials pulled from malware-infected devices. The file includes email addresses, plaintext passwords, and the URLs those logins were used on, packaged and shared by an anonymous Telegram user rather than obtained through any breach of Proton's own infrastructure.

Why This Is Dangerous

A dataset of this size, 6,921 individual credential sets, is small enough to be fully searchable in seconds and large enough to be worth an attacker's time. Because the passwords are stored in plaintext, there is no cracking step standing between the file and someone using those logins right now.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs associated with each credential pair

Why This Matters

Email login credentials are a particularly valuable target because email accounts are often used to reset passwords elsewhere. If any of the 6,921 exposed protonmail.co.uk passwords are reused on other services, those accounts become vulnerable to credential stuffing, and a compromised email account itself can be used to take over banking, shopping, or social media logins tied to it.

How Stealer Logs Work

Stealer malware sits quietly on an infected device and copies whatever the browser has saved: usernames, passwords, and the sites they belong to. Once collected, that information is bundled into a single file, called a log, and distributed. In this case, the log was shared for free on Telegram, but the same kind of file is often sold in bulk on criminal marketplaces.

Check If You Are Affected

Precise numbers like 6,921 only matter to you if your own email is one of them. HEROIC's free breach scanner checks your address against more than 400 billion exposed records, including logs like this one, so you can find out immediately and secure your accounts if needed.