The Plutonium-482 Leak Exposed More Records Than a Small US City

Two days after the first plutonium dump surfaced, HEROIC analysts found a second, larger file: "482-140K_plutonium," uploaded to Telegram on March 23, 2026. This version contains 47,529 verified records, each combining a website URL, an email address, and a plaintext password taken directly from an infected device.

Why the Plutonium-482 Leak Is Dangerous

Forty-seven thousand, five hundred and twenty-nine stolen logins is more people then live in many small American towns. Every one of those records is a working password, stored with no encryption, ready for anyone who downloads the file to start testing accounts immediatly.

What Was Exposed

• 47,529 verified login records
• Email addresses linked to each account
• Plaintext passwords, stored with no protection
• The exact URLs each credential was captured from

Why This Matters

A dump this size gives criminals enough volume to run large-scale credential-stuffing campaigns, automatically testing stolen logins against banks, email providers, and retailers. Anyone who reuses a password across even a couple of sites is at real risk of account takeover, fraud, or identity theft.

How the Plutonium Stealer Logs Are Built

Info-stealing malware quietly infects a device, often through a cracked game or fake software update, then harvests every password and cookie saved in the browser. The stolen data is bundled into a log file and distributed through Telegram channels, where sellers repackage and rename it, which explains why this dump and the earlier "481" file share the "plutonium" label.

Check If You Are Affected

Nearly 50,000 accounts were exposed in this one file. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records so you can find out in seconds whether you need to act.