The rwth-aachen.de Leak Contains Exactly 513 Email and Password Pairs

Stealer Log Tied to rwth-aachen.de Exposes 513 Records

HEROIC analysts identified a stealer log file tied to rwth-aachen.de that surfaced on a Telegram channel on June 10, 2026. The file contained exactly 513 records, including email addresses, plaintext passwords, and the URLs of the accounts those credentials unlock. The affected accounts appear tied to the university's email system, likely belonging to students, faculty, or staff.

Why This Is Dangerous

Stealer logs capture whatever was saved in a browser at the moment malware infected a device, so the passwords in this file are plaintext rather than hashed or scrambled. Paired with the matching URL for each account, an attacker does not need to guess where a password belongs. They can go directly to the correct login page and try it.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the accounts the credentials belong to

Why This Matters

University email accounts are often connected to more than coursework: banking apps, personal email forwarding, and social media logins. If any of these 513 people reused a password, an attacker can use credential stuffing to break into those other accounts, opening the door to account takeover, identity theft, and financial fraud.

How Stealer Logs Work

A stealer log is created when malware, often hidden inside a cracked program, fake download, or malicious attachment, infects a device and quietly collects everything saved in the browser: usernames, passwords, autofill data, and browsing history. That data is packaged into a log file and sent back to whoever controls the malware, then sold, traded, or uploaded to Telegram channels like the one where this file was found.

Check If You Are Affected

If you have ever used an rwth-aachen.de email address, or think your credentials might be part of this leak, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. It takes seconds to check and gives you a clear answer.