129,039 USA Accounts Named in the USA 8.27 Stealer Leak

HEROIC Analysts Uncover the USA 8.27 Stealer Log

HEROIC's threat intelligence team identified a large stealer log titled "USA 8.27" uploaded to Telegram by an anonymous user, dated January 14, 2023. The file contained 129,039 records, each combining an email address, a plaintext password, and the URL of the site the credentials were used on.

129,039 Accounts Named in the USA 8.27 Stealer Leak

This is one of the larger stealer logs HEROIC has tracked recently, and its size matters. A file this large is typically compiled from many different infected devices, meaning the 129,039 records represent a broad cross-section of real people's working logins, not a single source. Every entry pairs a live password with the exact site it unlocks, giving anyone who obtains the file a ready-made list of accounts to target.

What Was Exposed in the USA 8.27 Log

• Email addresses used to log into online accounts
• Plaintext passwords tied to those accounts
• The website URLs each credential pair was used on

Why This Matters for the 129,039 People in This Log

At this scale, automated attacks become the real threat. Criminals load lists like USA 8.27 into credential stuffing tools that test every email and password pair against dozens of popular websites in seconds, catching anyone who reused a password across accounts. For those affected, that can mean compromised email, banking, or shopping accounts long after they have forgotten the original password was ever at risk.

How a Stealer Log This Large Gets Assembled

Stealer logs come from infostealer malware, which infects devices through phishing emails, cracked software, or malicious ads, then quietly harvests saved browser passwords and autofill data. Large releases like USA 8.27 are usually built by combining the output of many separate infections into one file, which is then shared or sold on Telegram channels dedicated to trading stolen credentials.

Check If You Are Affected

With well over 100,000 records in this single log alone, the odds of your information being caught up in a stealer dump somewhere are real. HEROIC's free breach scanner checks your email against a database of more than 400 billion compromised records, so you can find out fast and secure any accounts still using an exposed password.