U.S. riseup.net Users: 1,341 Passwords Leaked in Dark Web Stealer Log

Riseup.net Credentials Found in a Dark Web Stealer Log

In June 2026, HEROIC analysts identified a stealer log circulating on Telegram that contained 1,341 exposed records tied to riseup.net, the U.S. based provider of secure email and communication tools. The log included email addresses, plaintext passwords, and the exact login URLs the credentials were used on, the classic fingerprint of malware that harvests saved browser data straight from an infected device.

Why This Is Dangerous

Because the passwords were stored and leaked in plaintext, anyone who obtains this log can log into an account immediately, no cracking or guessing required. Pairing an email address with its exact password and the URL it unlocks makes an attacker's job almost effortless. If the same password is reused anywhere else, including personal email, banking, or social media, that account is exposed too.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs (the exact pages the credentials unlock)

Why This Matters

Riseup.net is widely used by privacy conscious users, journalists, and activists, which makes stolen access to these accounts especially sensitive. Beyond the immediate account, exposed login pairs are routinely tested against other services in credential stuffing attacks, since so many people reuse passwords across sites. A single leaked password can open the door to account takeover, identity theft, and further data exposure well beyond the original riseup.net login.

How a Stealer Log Like This Gets Made

Stealer logs come from information stealing malware, such as RedLine, Raccoon, or Vidar, that infects a device (often through a pirated download, fake installer, or phishing link) and quietly copies everything saved in the browser: usernames, passwords, autofill data, and browsing history. The malware bundles this into a text file, the "log," and uploads it to a server or Telegram channel where it is sold, traded, or given away for free, exactly how this riseup.net data ended up circulating.

Check If You Are Affected

You do not need to guess whether your riseup.net login or any other account shows up in a stealer log or breach dump. HEROIC's free breach scanner checks your email address against a database of more than 400 billion breached and leaked records, including stealer logs like this one, so you can see your exposure and change any reused passwords before someone else finds them first.