Reused Passwords Put 107,606 People at Risk in the DE 6.25 Leak

HEROIC analysts identified a stealer log dataset, tracked as DE 6.25, that was leaked on 18-Jan-2023 and later uploaded by a Telegram user. The file contains 107,606 records pulled from infected devices, including email addresses, plaintext passwords, and the URLs of the login pages those credentials belong to.

Why This Is Dangerous

The people most at risk from this leak are not any single group, they are anyone in the file who has ever reused a password. Each of the 107,606 records pairs a working email address and password with the exact site it opens, so an attacker does not need special skills, just a list of accounts to try the same password on.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

With 107,606 records in this file, attackers have a large list to work through using automated tools. If a password from DE 6.25 was reused on another account, it can be used for credential stuffing, account takeover, and in more serious cases identity theft or financial fraud once an attacker reaches email or banking access.

How Stealer Logs Work

Stealer log malware infects a device, often through a fake download, cracked software, or a malicious attachment, and quietly copies saved browser passwords, autofill data, and session details. The stolen information is packaged into a log file and dated or labeled by the attacker, in this case as "6.25", before being shared through channels like Telegram. Because the malware pulls whatever the browser has saved, a single infected device can expose logins for dozens of unrelated accounts.

Check If You Are Affected

If you want to know whether your information appears in the DE 6.25 file or any other breach, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a scan now and change any reused password before someone else uses it first.