What is the difference between a breach and a stealer log?

Both show up in your scan results, but they come from very different places and carry different risks.

Traditional data breaches

A traditional breach occurs when an attacker compromises an organization's systems and steals its user database. The LinkedIn breach, for example, exposed over a hundred million accounts. If you had an account with the breached company, your data from that service is what leaked — often an email, a password hash, and profile details from a specific point in time.

Stealer logs

A stealer log comes from infostealer malware (families like Redline, Raccoon, or Vidar) installed on an individual's device. Rather than breaching a company, the malware harvests data directly from the victim's computer: saved browser passwords, cookies, autofill data, and session tokens for every site the victim used.

Why stealer logs are often more dangerous

Stealer logs frequently contain currently valid credentials — not a password you used in 2014, but the ones saved in your browser last month. Session cookies from stealer logs can even let attackers bypass passwords and 2FA entirely.

If your scan shows a stealer log hit, treat it as a live incident:

1. Run a reputable antivirus/antimalware scan on your devices.
2. Change passwords for the affected accounts after the device is clean.
3. Sign out of all sessions on important accounts to invalidate stolen cookies.

Access

LeakedSource indexes both types. Stealer log detail is available on Pro (personal) and Business plans due to its sensitivity.