U.S. Users Targeted: USA Hits Exposes 91 Stolen Passwords

In November 2024, HEROIC's DarkHive threat intelligence platform detected a stealer log file labeled "USA Hits" being shared on Telegram. The dump contains 91 compromised credential records specifically targeting American users. Each record includes an email address, a plaintext password, and the URL of the compromised service — all verified as active logins at the time of distribution, making them immediately exploitable.

Plaintext Passwords With No Protection

Every credential in the USA Hits dump is stored in plaintext, offering no cryptographic defense whatsoever. The passwords are fully readable and can be used to access accounts the moment they are obtained. Combined with the "Hits" designation confirming each credential works, this dataset presents an immediate and concrete threat to the 91 individuals whose accounts are compromised.

What Was Exposed

• Email Addresses — U.S.-based accounts spanning personal, professional, and financial services
• Plaintext Passwords — verified active and stored without any form of encryption
• URLs — pinpointing the specific American services and platforms each credential unlocks

Geographic Targeting Increases Exploitation Value

Country-specific credential dumps like USA Hits are prized by attackers because they allow focused campaigns against high-value services. American accounts are frequently linked to U.S. banking institutions, healthcare portals, government services, and major e-commerce platforms. Credential stuffing attacks using these 91 verified logins can target services like Chase, Wells Fargo, IRS portals, and health insurance accounts — where unauthorized access can lead to direct financial loss and identity theft.

The Infostealer Connection

The 91 credentials in this dump were silently extracted from American users' devices by infostealer malware. These programs commonly infect computers through phishing emails, trojanized software, and malicious advertisements targeting English-speaking audiences. Once installed, the malware harvests every credential stored in the victim's web browser, steals active session cookies for bypassing authentication, and captures autofill data including addresses and payment details. The stolen data is filtered by geography, tested for validity, and packaged into targeted dumps for distribution.

Check If Your Credentials Were Exposed

HEROIC's breach intelligence platform indexes over 400 billion compromised records from known breaches, stealer logs, and credential dumps across the globe. Use HEROIC's free breach scanner to search for your email address and discover whether your credentials appear in the USA Hits dump or any other known data breach. If your information is found, take immediate action: change all affected passwords and enable two-factor authentication on every account.