Someone Has Your Password: 98K AOL Credentials Leaked

HEROIC threat intelligence analysts discovered a stealer log compilation titled 100k UHQ AOL Base that was uploaded to a public Telegram channel in April 2023. The dataset contained 98,679 individual records, each pairing an email address with a plaintext password and the URL where that credential was used. The dump was freely accessible, putting tens of thousands of account holders at immediate risk of unauthorized access.

Why Unencrypted Passwords Put You at Immediate Risk

Every password in this dump was stored in plaintext, meaning there is no hashing or encryption standing between an attacker and your account. An attacker who downloads this file can begin testing credentials within moments, logging into email accounts, financial platforms, and social media profiles without needing any specialized tools or technical knowledge.

Plaintext exposure is the worst-case scenario for credential security. When passwords are hashed, attackers must invest time and computing power to reverse them. With plaintext, that barrier disappears entirely. The speed advantage this gives threat actors cannot be overstated, as automated login attempts can cycle through the entire 98,679-record dataset in hours.

What Was Exposed in the 100k UHQ AOL Dump

• Email Addresses — Personal and professional email addresses that serve as both login identifiers and direct communication channels, enabling targeted phishing and social engineering campaigns.
• Plaintext Passwords — Fully readable passwords extracted from infected devices, requiring zero additional processing before they can be used to access victim accounts.
• URLs — The exact web addresses where each credential pair was entered, revealing which specific services and platforms each victim frequented.

Why Nearly 99K Exposed Accounts Multiply the Damage

Password reuse remains one of the most persistent vulnerabilities in personal cybersecurity. Studies indicate that the average person reuses passwords across at least five different services. When 98,679 credential pairs leak in plaintext, the true number of vulnerable accounts could easily reach into the hundreds of thousands.

Attackers employ credential stuffing, an automated technique that tests stolen username-password pairs against large lists of popular websites. A single valid match on a banking site, corporate VPN, or cloud email service can yield far more value than the original compromised account. The AOL email addresses in this dump are particularly concerning because email accounts often serve as recovery mechanisms for other services, creating a master key effect.

Once an attacker controls an email account, they can reset passwords on linked services, intercept two-factor authentication codes sent via email, and impersonate the victim to contacts and colleagues.

How Stealer Logs Silently Harvest Your Data

The credentials in this dump were collected by infostealer malware running on victims' devices. Programs like Lumma, RedLine, and META Stealer infiltrate systems through deceptive downloads, fake software updates, and compromised websites. Once active, they silently extract saved passwords from browsers, record keystrokes, and copy authentication cookies.

The stolen data is organized into structured log files and exfiltrated to servers controlled by the malware operators. These logs are then sold in bulk on underground forums or distributed freely on Telegram channels to build reputation. The 100k UHQ AOL Base dump represents one such distribution, where the compiled logs were made available to anyone with access to the channel.

Victims rarely know they are infected. Infostealers are designed to operate with minimal system impact, avoiding detection by antivirus software and running silently in the background while continuously siphoning credentials from every site the user visits.

Check If Your Credentials Were Exposed

You do not need to wait for a notification to find out whether your data is in this dump. HEROIC provides a free breach scanning tool that checks your email address and credentials against more than 400 billion compromised records from breaches, stealer logs, and dark web marketplaces.

If your credentials appear in the 100k UHQ AOL dump or any other known leak, take action immediately. Change the compromised password everywhere it was used, switch to a unique password for every account, activate multi-factor authentication, and scan all your devices with reputable anti-malware software to eliminate any lingering infostealers.