US Users Exposed: Xavier_Log 4222 Premium Leaks 10,548 Logins

Labeled for United States users and uploaded straight to a Telegram channel on 28-May-2026, the file Xavier_Log - 4222 Xavier_Group Premium.part4 uploaded by a Telegram User packs 10,548 stolen login records into what its uploader calls a "premium" batch. Premium, in this case, just means the credentials are fresher and presumably still work.

Why This Is Dangerous

Region-tagged stealer logs like this one are appealing to attackers because it narrows down wich services, banks, and platforms are likely to show up in the file. A criminal targeting US-based accounts doesn't have to sift through irrelevant data from other countries, they can go straight to work testing logins that are already geographically relevant.

What Was Exposed

• 10,548 total records
• Email Addresses
• Plaintext Password
• URLs for each affected site

Why This Matters

It's not neccessary for an attacker to target you personally to put your account at risk. Being included in a bulk, region-focused log like this one is often enough, since automated tools can test thousands of leaked username and password combinations against popular US banking and retail sites within minutes.

How Stealer Log Breaches Work

This kind of log is built by malware that lives quietly on an infected computer, watching for saved passwords, browser autofill entries, and login sessions. Once it collects enough, it exports everything into a single file labeled by batch or "part," like the part4 tag on this one, and the file gets uploaded or sold as a distinct product.

Check If You Are Affected

If you're in the United States and use any of the sites likely represented in this dump, it's worth a quick check. HEROIC's free breach scanner searches a database of more than 400 billion leaked records so you can see in seconds whether your information turned up here.