The XIII_RESULTS Dump Exposed 2,630 US Login Credentials

In May 2023, a verified stealer log dataset known as XIII_RESULTS 28.05.2023 12.31.07 uploaded by a Telegram User appeared on Telegram, exposing 2,630 records tied to United States-based accounts and services. HEROIC analysts confirmed the file contained email addresses, plaintext passwords, and the specific URLs where each credential was entered. The timestamp in the filename, 12.31.07, reveals the precise moment the log was compiled, a detail that highlights just how systematically these operations are run by the threat actors who profit from them.

Why This Is Dangerous

Some people beleive that a dataset of 2,630 records poses minimal risk because of its small size. That reasoning misses the point entirely. Every record in this file represents a real person whose credentials are immediately usable. Plaintext passwords paired with the exact URLs where they were entered give attackers a precise attack surface, allowing them to skip broad credential stuffing and go directly to the targeted platforms with high confidence. Smaller stealer logs are frequently traded or sold to individuals rather than organized criminal groups, which means the threat can come from a wider and less predictable range of bad actors.

What Was Exposed

• Email Addresses: Account identifiers that link victims directly to their online accounts across dozens of platforms and services
• Plaintext Passwords: Unencrypted, immediately usable credentials captured live from infected machines without any hashing or obfuscation
• URLs: Exact website addresses showing precisely where each password was used, eliminating any guesswork for the attacker

Why This Matters

Once an email address and plaintext password are in an attacker's possession, the path to financial fraud is shorter than most people realise. Credential stuffing tools can test these pairs against email providers, banking apps, and online retailers in a matter of minutes. A succesful login to an email inbox is especially valuable because it unlocks password reset flows for every other account tied to that address, creating a chain of account takeovers that can happen rapidly and without warning.

From there, unauthorised purchases, fraudulent loan applications, and identity theft can cascade quickly. Victims often do not discover the problem until bank statements arrive, accounts are locked, or a third-party notification service flags the activity. By that point, reversing the damage demands significant time, and some losses may never be fully recovered.

How Stealer Logs Work

Information stealer malware infects devices through common entry points including fake software downloads, pirated applications, and phishing emails with malicious attachments. Once active, it runs silently in the background and extracts saved browser credentials, cookies, autofill data, and session tokens without triggering visible alerts.

The collected data is packaged into a structured log file and transmitted to the attacker's server. The designation XIII_RESULTS, paired with the precise timestamp, suggests this log was generated by an automated system that compiles and exports credential batches at scheduled intervals. This level of organisation points to a professional threat actor running an ongoing operation rather than a one-time incident. The file was then uploaded to Telegram, where subscribers could access it freely and immediatly.

Because the malware leaves little trace, most victims have no idea their credentials were captured until they recieve a breach alert or notice suspicious activity on an account.

Check If You Are Affected

HEROIC's free breach scanner indexes more than 400 billion compromised records, including stealer log files like XIII_RESULTS that circulate through Telegram channels and dark web forums. If your email address appeared in this dataset or in any of thousands of other known breaches, HEROIC will show you exactly what was exposed and what steps to take immediately.

The check is completely free and takes under a minute. Enter your email at HEROIC's breach scanner today to find out whether your credentials are already in the hands of attackers, before they use them.