Summary
Troy Hunt’s Have I Been Pwned (HIBP) service has ingested a massive trove of stealer log data accumulated from multiple infostealer malware campaigns throughout early 2026. The corpus contains 56 million unique email addresses and 124 million unique passwords, all harvested from credential-stealing malware that silently exfiltrates browser-stored passwords, session tokens, and autofill data from infected machines.
The stealer logs — aggregated from underground markets and Telegram channels where they are routinely traded — represent a significant escalation in the volume of compromised credentials circulating in the criminal ecosystem. All 124 million unique passwords have been added to HIBP’s Pwned Passwords service, and individuals can check their exposure through the stealer logs section of their HIBP dashboard. Organizations can also monitor for domain-level exposure via the stealer logs API.
Infostealer malware families like RedLine, Raccoon, Vidar, and Lumma continue to be the primary drivers behind these collections, typically distributed through cracked software downloads, malvertising, and phishing campaigns.
Source
Have I Been Pwned — June 2026 Stealer Logs · HIBP Pwned Websites
Commentary
Stealer logs are arguably the most underappreciated threat vector in modern cybersecurity. Unlike traditional breaches where a single company’s database is dumped, stealer logs represent the aggregate output of millions of individual compromises — every infected machine contributing a slice of its owner’s digital life. The credentials harvested aren’t just passwords; they’re often accompanied by session cookies that can bypass MFA entirely.
56 million emails is a staggering number, and the real-world impact goes well beyond account takeover. These logs feed initial access brokers, business email compromise campaigns, and ransomware operators shopping for VPN and RDP credentials. If your organization isn’t actively monitoring stealer log exposure through services like HIBP or Hudson Rock, you’re flying blind against one of the most prolific credential compromise vectors in the threat landscape.