Yahoo 28.09 Leak: 220,690 Logins, More Than a Small City

220,690 Records Surface in a Yahoo-Focused Stealer Log Named "yahoo 28.09"

HEROIC's dark web monitoring team identified a stealer log named "yahoo 28.09," uploaded to a Telegram channel on 07-May-2023. The file contains 220,690 records, each pairing an email address with a plaintext password and the URL of the site the credentials were captured from. That's more accounts than the population of many small cities, all sitting in a single file.

Why the yahoo 28.09 Stealer Log Is Dangerous

This file is dangerous because it removes every barrier between an attacker and a working login. Each record already ties a specific email and password to the exact website it unlocks, so there's no guessing or cracking required. Because the passwords are stored in plaintext, anyone who obtains the file can read them instantly and start using them right away.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the websites where the credentials were used

Why This Matters

With over 220,000 working email and password combinations in one file, this is prime material for account takeover, since each record lets an attacker log directly into a specific account. It also drives credential stuffing: if you reused that same email and password combination anywhere else, those accounts are at risk too, regardless of whether they're named directly in this file.

How Stealer Logs Work

Stealer logs come from malware that infects a device, quietly copies saved passwords and active browser sessions, and sends everything back to whoever controls the malware. The result is a plain text file listing exactly which login works on which website, taken straight from the source. Files like "yahoo 28.09" are then packaged and traded on Telegram, which is exactly where HEROIC analysts found this one.

Check If You Are Affected

With over 220,000 records in this file, checking whether you're included is worth doing rather than assuming you're safe. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, and tells you immediately if you've been exposed. If you get a match, change that password right away and avoid reusing it anywhere else.