The SEGA 13122 Leak Gave Attackers Everything for Account Takeover

HEROIC analysts identified a stealer log file uploaded to a public Telegram channel on December 13, 2022, tied to a source labeled SEGA 13122. The file contains 18,502 records, each pairing an email address with a plaintext password and a URL for the account it unlocks.

Why the SEGA 13122 Leak Is Dangerous

Every password in this dataset was stored in plaintext, so anyone who downloads the file can log in right away with no cracking required. The included URLs point directly to the login pages tied to each credential pair, giving an attacker a fast, direct path from the raw file to an active account.

What Was Exposed in the SEGA 13122 Leak

• Email addresses
• Plaintext passwords
• URLs (linked login endpoints)

Why This Matters

These credentials were captured directly from infected devices, meaning they were working logins at the time of theft. If you reused any of these passwords elsewhere, attackers can attempt credential stuffing against your email, banking, or social media accounts. The paired email addresses also make follow-up phishing attempts more convincing.

How Stealer Log Leaks Like This Happen

A stealer log is created when infostealer malware infects a device, quietly copies saved browser passwords, autofill data, and the URLs tied to each login, then sends it all back to the attacker. Many of these logs are shared for free on Telegram channels, which is exactly how this 18,502-record file became publicly accessible.

Check If You Are Affected

If you want to know whether your email or passwords appear in this leak or any other, HEROIC's free breach scanner checks your details against a database of more than 400 billion exposed records. Run a scan and update any password you have reused elsewhere.