Dark Web Intel: sbb.ch Stealer Log Leaks 571 Passwords Online

HEROIC Dark Web Intel Flags sbb.ch Logins in a Stealer Log

HEROIC's dark web monitoring identified a stealer log, shared on Telegram in June 2026, containing 571 records tied to sbb.ch, the domain used by the Swiss Federal Railways. The log paired email addresses with plaintext passwords and the exact URLs each login was used on, a format that points to malware harvesting rather than a breach of SBB's own systems.

Why This Is Dangerous

Plaintext passwords mean there is nothing standing between the data and an attacker's next login attempt. Whoever collected this log can try these 571 email and password pairs against the associated accounts right away, and if any of these users reused their password elsewhere, the risk extends well past the original sbb.ch login.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs (the exact pages the credentials unlock)

Why This Matters

Transit and travel accounts often store payment details, personal information, and travel history, all of which can be leveraged for fraud or identity theft. Attackers commonly feed leaked credentials like these into automated credential stuffing tools, testing them across banking, email, and shopping sites in search of a working password.

How This Kind of Dark Web Intel Gets Collected

Stealer logs originate from infostealer malware planted on a victim's device through phishing links, cracked software, or fake downloads. The malware exports every saved username, password, and site from the browser, and that file is then uploaded to Telegram channels and dark web marketplaces where analysts like HEROIC's team can find and flag it, exactly how this sbb.ch data was discovered.

Check If You Are Affected

Do not wait to find out if your credentials are part of a log like this one. HEROIC's free breach scanner cross-references your email against more than 400 billion breached and leaked records collected from the dark web, giving you a fast, clear answer so you can secure any exposed account.