US Users Hit as Moon Light Private Leak Exposes 1M+ Records

A file calling itself "MOON LIGHT PRIVATE 2" showed up on Telegram back on 05-Oct-2025, carrying with it 1,023,509 records tied mostly to users inside the United States. Over a million logins from one country, sitting in a single download for anyone who wanted it.

Why This Is Dangerous

When this much data from a single region gets concentrated into one file, it becomes especially attractive to criminals who specialize in targeting that country's banks, retailers, and email providers. Attackers can tailor their follow up scams specifically to US based services, making the fake emails and login pages feel more convincing.

What Was Exposed

• 1,023,509 records
• Email Addresses
• Plaintext Password
• URLs tied to US based accounts

Why This Matters

If you live in the United States and use common webmail or shopping accounts, a leak this size increases the odds that your information ended up somewhere in the file, even if just by chance. With over a million records to work through, attackers don't need every single one to work, they only need a small percentage to make the effort worthwile.

How Stealer Logs Work

This kind of file is built from malware infections spread across thousands of individual devices, each one contributing a handful of saved passwords and browsing details. Once collected, the stolen data from all those computers gets merged into a single massive log so buyers can recieve everything in one download, all under a catchy name to attract buyers.

Check If You Are Affected

With over a million records in play, checking your own status only takes a minute. HEROIC's free breach scanner searches more than 400 billion leaked records worldwide, including this one, so you can see right away if you need to change a password.