RedLine Stealer Malware Exposes 441,657 Email Addresses, Usernames, and Plain‑Text Passwords
What Happened — In December 2021, logs from the RedLine Stealer information‑stealer malware were inadvertently published. Security researcher Bob Diachenko retrieved the files, which contained 441 657 unique email addresses, usernames and clear‑text passwords.
Why It Matters for Trust & Control Assurance
- Highlights the risk of credential theft that continuous identity‑and‑access‑control programs are designed to detect, contain, and evidence.
- Demonstrates the need for real‑time monitoring of credential exposure and rapid remediation to maintain a defensible audit trail.
- Underlines the importance of security‑awareness training and strong password policies as preventive controls.
Who Is Affected – Organizations across all sectors that rely on user credentials for access, especially those with legacy password practices.
Recommended Actions –
- Force password resets for any accounts that may have used the exposed credentials.
- Enforce multi‑factor authentication (MFA) wherever possible.
- Deploy continuous credential‑monitoring solutions to detect reuse of compromised passwords.
- Review and tighten password‑policy settings (complexity, rotation, storage).
- Document the response in your incident‑response log for audit readiness.
Technical Notes – The breach stems from the RedLine Stealer malware, an info‑stealer that harvests credentials from infected endpoints. No specific CVE is involved; the exposure resulted from the public release of the malware’s log files.