Your Data May Be Exposed: The USA 1 Leak Hit Nearly 10,000 Accounts

In early July 2026, HEROIC threat intelligence analysts identified a stealer log file uploaded to Telegram under the name "USA 1," containing 9,992 records tied to US-based accounts. The file includes email addresses, plaintext passwords, and the URLs of the login pages each credential was pulled from.

Why Nearly 10,000 US Accounts in One File Is a Serious Concern

A batch approaching 10,000 records means a large number of individual people, all filtered specifically to US accounts, have working login details circulating in a single file. At this size, the data is less likely to be a small test upload and more likely to be an actively distributed product being sold or shared to a wide pool of buyers.

What Was Exposed in the USA 1 File

• Email addresses
• Plaintext passwords
• URLs of the login pages tied to each credential

Why This Matters at Nearly 10,000 Records

Because the passwords are stored in plain, readable text, anyone with the file can attempt to log in immediately, no cracking required. At this scale, criminals typically automate the process, testing each email and password pair against major banks, email providers, and shopping sites, a method called credential stuffing. That kind of bulk attempt is how a single leaked password can quickly turn into account takeover, financial fraud, or identity theft for thousands of people at once.

How a Country-Specific Batch of This Size Gets Built

Infostealer malware collects saved usernames, passwords, and login URLs from infected devices regardless of where the victim lives. Sellers then sort that raw data by country to create large, targeted files like this one, since buyers on criminal marketplaces often want volume from a specific region to run bulk credential stuffing campaigns. A file labeled "USA 1" with almost 10,000 records suggests this may be the first of several batches being distributed under that name.

Check If Your Account Was in This Batch

With nearly 10,000 records in circulation, checking your exposure is worth doing now rather than later, especially if you are based in the US or reuse passwords across accounts. HEROIC's free breach scanner searches more than 400 billion leaked records, including stealer logs like this one, so you can confirm whether your information was included and update any affected passwords before someone else logs in first.