2,520 Logins for USAA Accounts Surface in a Stealer Log File

Every one of the 2,520 records inside this stealer log pairs a stolen email address with a plaintext password used to log into USAA accounts, based on the URL captured alongside each credential. HEROIC analysts confirmed the file was pulled from infected devices in late July 2024.

Why the USAA Label Does Not Mean USAA Was Hacked

This file did not come from USAA's own systems. It is a stealer log, meaning malware on individual victims' devices copied their saved USAA login the same way it copied every other saved password, then bundled the results together under a label naming the site.

What Was Exposed

• Email Addresses: the identifier matched to each stolen password.
• Plaintext Passwords: fully readable, usable the moment the file is opened.
• URLs: confirms each credential pair was captured on a USAA login page.

Why Logins for a Financial Account Carry Extra Risk

A pairing this specific, email, password, and confirmation it works on a banking login page, is exactly what an attacker wants for direct financial fraud. Unlike a general password leak, there is no guessing involved here about what the credential unlocks. That certainty is precisely what makes a file like this more valuable to an attacker than a random assortment of unlabeled passwords.

How These USAA Logins Ended Up in a Stealer File

Infostealer malware on an infected device reads directly from the browser's saved passwords, capturing the site, email, and password together exactly as the browser stored them. The device itself was compromised, not any bank's servers.

Is Your USAA Login Among the 2,520?

Scan your email to check your exposure. If you find a match, contact USAA directly to secure the account and change the password immediately, ideally from a device you have confirmed is clean. Watch your statements closely for unfamiliar activity in the weeks after, and update the password anywhere else you reused it, on personal and work devices alike.