Your Login May Be Exposed: The Bell.ca Leak Hit 522 Accounts

HEROIC analysts found a stealer log tied to bell.ca that a Telegram user uploaded on 10 June 2026. The file contained 522 records, each one an email address paired with a plaintext password and the URL of the login page that password was captured on.

Why This Is Dangerous

This exposure did not come from bell.ca's own systems being breached. It came from infostealer malware running on infected devices, quietly recording login details as people used them. Because the passwords in this file are stored in plaintext, an attacker can read them the instant they open the file, no cracking required. The URL tied to each record tells an attacker exactly which login page a stolen password belongs to.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each set of stolen credentials

Why This Matters

Telecom and account service passwords are often reused across email, banking, and streaming logins, which makes a leak like this one riskier than the record count alone suggests. Attackers take stolen credentials and run them against other sites through credential stuffing, hoping a password still works. A successful match leads to account takeover, which can quickly become identity theft or financial fraud.

How Stealer Logs Work

Infostealer malware infects a device through a malicious download, phishing link, or infected file, then it silently copies saved passwords, autofill entries, and session cookies from the browser. That stolen information is bundled into a log file and sent to the attacker, often within hours of infection. These logs then circulate on Telegram channels, which is how this bell.ca related file was discovered.

Check If You Are Affected

If you have a bell.ca account or reuse passwords across multiple sites, it is worth checking whether your information appears in this exposure. HEROIC's free breach scanner searches more than 400 billion leaked records so you can find out and change any exposed password right away.