Qatar Airways Domain Breach: Exactly 1,201 Passwords Leaked

What HEROIC Analysts Found

In June 2026, HEROIC analysts found a stealer log posted to Telegram containing exactly 1,201 records tied to qatarairways.com.qa, the domain used by Qatar Airways. The log included email addresses, plaintext passwords, and the login URLs those credentials open. This data was harvested from infected personal devices, not a breach of the airline's own systems, and packaged into one file for distribution.

Why This Is Dangerous

An email address alone tells an attacker little, and a password alone is only useful if you know what it unlocks. This log removes that uncertainty by pairing each password with the exact login URL it belongs to, meaning an attacker can log straight into an account without guessing or cracking anything.

What Was Exposed

• Email addresses
• Plaintext (unencrypted) passwords
• Login URLs tied to each set of credentials

Why This Matters

Because these passwords are stored in plaintext, they can be used the moment someone downloads the file. Anyone who reused a qatarairways.com.qa password on another account is exposed to credential stuffing, where the same login is tested automatically across banking, email, and travel accounts. Travel and loyalty accounts in particular can be valuable to attackers, since they may hold saved payment details or reward points that can be resold.

How Stealer Logs Like This One Get Made

This leak traces back to infostealer malware, malicious software that infects a device, often through a fake download or cracked application, and quietly copies saved browser passwords, autofill data, and active sessions. The results are compiled into a log and posted to Telegram, where they can be merged with other logs into larger searchable collections.

Check If You Are Affected

If you have a qatarairways.com.qa account, it's worth checking whether your credentials are among the exact 1,201 exposed. HEROIC's free breach scanner checks your email against a database of more than 400 billion exposed records, including stealer logs like this one, so you can find out in seconds.