U.S. Devices Hit Hardest in 10,456-Record Xavier_Log Leak

The United States takes the brunt of this one. Uploaded to Telegram on 06-Feb-2026, this Xavier_Log file is the biggest in the series so far, holding 10,456 records almost entirely pulled from infected devices located in the U.S. Each entry includes an email address, a plaintext password, and the exact URL that login unlocks.

Why This Is Dangerous

A file this size, concentrated so heavily in one country, gives attackers a dense target list to work through. Since none of the passwords are encrypted, criminals don't waste time cracking anything, they simply read the file and start trying logins. The country focus also means many of these accounts likely connect to services common across the U.S., from banking apps to major retailers, making the stolen data even more useful to whoever grabs it.

What Was Exposed

• 10,456 total records, the largest batch in this series
• Email addresses tied to U.S. based accounts
• Plaintext passwords with zero protection
• URLs identifying exactly which login each record affects

Why This Matters

When a leak concentrates on a single country, it's more likely to line up with services people in that region actually use every day. That overlap makes credential stuffing attacks especially effective, since a stolen password from one U.S. based account often works on another. Anyone in the affected group faces a real chance that more than one of their accounts is exposed, even if they don't relize it yet.

How Stealer Logs Work

None of this data leaked because a company's systems were hacked. It comes from malware that infects individual devices, usually smuggled in through cracked software, fake downloads, or malicious attachments. Once running, it quietly pulls saved passwords, autofill data, and cookies straight from the browser, then compiles it all into a log file. That file gets sold or given away on forums and Telegram channels, seperate from wherever the original infection took place, and victims rarely notice until the damage shows up somewhere else.

Check If You Are Affected

With a leak this large, it's worth checking sooner rather than later. HEROIC's free breach scanner checks your email against more than 400 billion leaked records from breaches and stealer logs across the internet. If you turn up in the results, change that password right away and use a different one for every account you own.