Someone Has Your Password: 4,144 Credentials in China 14.05 Leak

HEROIC analysts identified a stealer log collection labeled "4.2K China 14.05" that was uploaded to a Telegram channel in May 2026. The dataset contains 4,144 compromised records targeting users with connections to Chinese platforms and services. Each record exposes an email address, a plaintext password, and the URL where the login was captured. As a recently surfaced collection, the credentials in this dump are likely still active and exploitable.

Why Fresh Plaintext Passwords Demand Immediate Action

The credentials in the China 14.05 dump are stored in plaintext — fully readable and ready for immediate use. Unlike older leaked data where victims may have already changed passwords, this collection surfaced in May 2026, meaning many of these credentials are likely current. Attackers who obtain this data can begin accessing accounts within minutes, with a high probability that the passwords still work.

The recency of this leak significantly elevates its danger. When credentials are fresh, the window between exposure and exploitation is at its narrowest. Automated scanning tools monitor Telegram channels for new uploads and can begin testing credentials against live services within hours of a dump appearing.

What Was Exposed in the China 14.05 Dump

• Email Addresses — Email accounts used to register on various online platforms, providing attackers with both login identifiers and direct communication channels for phishing.
• Plaintext Passwords — Completely unencrypted passwords captured from infected devices, requiring no cracking or decryption to exploit.
• URLs — The websites and services associated with each credential set, revealing which platforms each victim used and guiding targeted attack campaigns.

Why Even 4,144 Records Pose Serious Risk

While smaller in volume than some mega-dumps, a collection of 4,144 credential pairs remains a potent tool for targeted attacks. Smaller datasets are often more focused and curated, meaning a higher percentage of the credentials may be valid and current. Attackers frequently prefer compact, high-quality sets over massive but stale collections.

Password reuse amplifies the impact far beyond the initial 4,144 accounts. Each credential pair that works on one service is immediately tested against email providers, financial platforms, cloud storage, and social networks. With reuse rates consistently above 60%, a small dump like this can lead to thousands of additional compromised accounts across unrelated services.

How Stealer Logs Capture Credentials Across Borders

Infostealer malware does not respect geographic boundaries. Malware distributed through phishing emails, fake software, and malicious advertisements infects devices worldwide. Once active on a machine, it extracts every saved credential from browsers and applications — regardless of whether the websites are Chinese platforms, international services, or anything in between.

The "China" label on this collection indicates a regional focus in the harvested data, but the malware itself may have infected devices anywhere in the world. After extraction, the stolen data is packaged into logs and uploaded to Telegram channels where it is freely shared or sold. Even a collection of 4,144 records represents thousands of individual privacy violations and potential avenues for financial fraud and identity theft.

Check If Your Credentials Were Exposed

Because this collection surfaced recently, anyone who has used Chinese platforms or services — or simply had credentials saved on a device that was compromised — should verify their exposure. The freshness of this data makes immediate action especially important.

Use HEROIC's free breach scanner to check whether your email address or passwords appear in the 4.2K China 14.05 dump or across our database of 400B+ compromised records. If your credentials are found, change your passwords on all affected services immediately and enable two-factor authentication to prevent unauthorized access.