Stealers Take Your Passwords. Breaches Take Your Email. Ransomware Takes Everything.

One infected laptop, one leaked website, one hacked company: three very different kinds of exposure

An infostealer log holds a median of 14.5 saved logins and, in about one log in three, an Instagram session or saved login. A traditional breach is usually one flat table. A ransomware leak is a company's file server: 93% of the ransomware-leak sources indexed in the last 30 days contain real documents, spreadsheets or e-mail files. Only 14% of traditional-breach sources do.

Most people hear "data breach" and picture one thing. In reality, three very different kinds of exposure end up in the same underground ecosystem, and they do not hurt in the same way. This article puts them side by side using what HaveIBeenRansom (HIBR) actually indexed: 831 traditional-breach sources and 124 ransomware-leak sources indexed between 2026-09-11 and 2026-10-11, plus 216 infostealer logs pulled through the stealer endpoint.

The short answer

Traditional breaches win on raw volume (3.30 billion records against 509.9 million), because a few forum dumps are gigantic. Ransomware leaks win on what is inside each record. And stealers are a different animal altogether: tiny per victim, but personal in a way neither of the others is.

Stealers: your Instagram, your Steam, your wallet

An infostealer is malware that silently copies everything a browser and a PC remember: saved passwords, session cookies, autofill data, game launchers, messaging apps and crypto wallets. Each "log" is one infected machine. To see what that looks like, we sampled 216 logs (the first pages of the HIBR stealer endpoint for the US, Spain, Brazil and Germany; 24 obvious test entries were removed) from the RedLine, Lumma, StealC, META and Meduza families.

What the sample shows:

• 32.4% of logs carry an Instagram session or saved login, and 35.2% carry Facebook.
• 55.6% include Steam data (the client folder, a SteamID or Steam cookies), and 57.4% include Discord.
• 7.9% reference a crypto wallet or exchange (a wallet folder, or sessions on exchanges such as Binance, Coinbase or Kraken).
• 10.2% include Telegram data, and 6.5% contain a saved credit-card folder.
• 77.3% contain saved logins: 12,740 credentials in total, a median of 14.5 and a mean of 59 per log, plus 31,705 cookie domains.

To make it concrete, this is the shape of a typical record. This is an illustrative composite of fields we saw across the sample; all values are masked or invented.

HWID:        9F3A…(masked)         Stealer family: RedLine
Country:     ES                     Log date: 2023-05-17
instagram.com   → session cookie present
Steam           → SteamID 7656119********  (masked)
Wallets         → folder present, address 0x4f…(masked)
Credentials     → 15 saved logins (site / user / password: not shown)

A stealer log is personal and live: a session cookie can let an attacker walk into an account without even knowing the password. But it is also small and individual. One log is one person's digital life, not their employer's.

Traditional breaches: huge, but flat

A traditional breach is typically a copy of one website's user table, or a "combolist" of e-mails and passwords reshuffled from older leaks. In our 30-day window:

• 831 sources, 3.30 billion records, but a median source of only 32,979 records.
• Only 13.6% of sources contain any document-type file, and only 3.9% contain four or more kinds of file.
• 99.0% of all records sit in flat files (CSV, TXT, JSON). Just 0.42% are spreadsheets.

Look at the biggest ones. A re-listed 2022 archive from the Russian courier company CDEK holds 642,290,466 records in one CSV, with 48.3 million e-mail addresses. "Fling_BF.7z" holds 40.8 million records in a single JSON file. "Armorgames.com 7.7kk.txt" is 7,650,688 records in one text file, 89.2% of whose e-mail addresses are personal webmail. "[614K] Morele.net" is 614,436 records, 68.1% personal webmail, described by the poster as an e-mail:password list.

These are painful for the people in them. Reused passwords get tried everywhere, and e-mail lists feed phishing. But it is a column of e-mails and a column of passwords, not a view into anyone's working life.

Ransomware leaks: the whole company on a plate

When an extortion crew leaks a victim, it is not a table. It is whatever the attackers could copy out of the network: file shares, spreadsheets, database exports, mailboxes. That is why the numbers change:

• 124 sources, 509.9 million records, with a median of 173,258 records, 5.3 times the median of a traditional breach.
• 92.7% of sources contain documents, spreadsheets or e-mail files; 57.3% contain four or more kinds of file.
• 54.3% of the e-mail addresses are "Corporate" (anything that is not a free webmail domain), against 20.2% in traditional breaches.
• 63.9 million records are Excel spreadsheets (.xls and .xlsx) in ransomware leaks, against 13.9 million in traditional breaches, even though traditional breaches have six times more records overall.

Here are the leaks of the window that show it best. Names are the victim names as listed in HIBR; what the groups claim is their claim, not a confirmed fact.

• Restaurant Depot (US, listed by the group play): 57,793,776 records, 27.5 million e-mail addresses counted, 14.3 million records in document-type files, nine kinds of file.
• Record Go Alquiler (Spain, play): 51,968,447 records, of which 20.5 million are in document-type files, nine kinds of file. Document-heavy leaks from a rental business are the kind that can identify customers far beyond an e-mail address.
• Exact Sciences (US, shinyhunters): 54,705,305 records, 20.5 million e-mail addresses counted, five kinds of file. The listing is a health-sector name, so the sensitivity question is obvious; the post itself carries the group's ultimatum language.
• Questel SAS (France, shinyhunters): 8,696,752 records, 4.8 million in document-type files, nine kinds of file. The group's own post claims more than 21 million Salesforce records and 147 GB of internal corporate data; we cannot verify that.
• CyrusOne (US, shinyhunters): 8,407,718 records, 3.2 million in document-type files, ten kinds of file. The group's note mentions a ransom demand; we have not verified it.

Size alone is not depth: McKesson (98.4 million records) and Sysco (43.0 million) are in the same window, but their file breakdowns are almost entirely flat tables. That is exactly why we look at what kind of data is inside, not only how much.

The forensic reading

Stealers. A log is an evidence bundle from one endpoint. Its value to an investigator is the machine identity (hardware ID, stealer family, log date) and the account inventory. It tells you which sessions were exposed, but the log date matters: a cookie from 2022 is likely dead, a saved password from 2022 may not be.

Traditional breaches. A breach is a snapshot of a data store. Forensically, the questions are: which table, how old, how many unique e-mails, how much is recycled from other dumps. Because these are flat, deduplication and the reuse of older data are the main analytical problems.

Ransomware leaks. A leak is a copy of a file system and databases, taken at one moment, under duress. A single archive can combine HR spreadsheets, customer exports, contracts, invoices and mail files. From that you can reconstruct who works where, who reports to whom, which customers pay what, and which supplier owns which contract. HIBR measures this through its metadata: e-mail origin (Corporate vs Personal), file types, identity-document detection, top domains and countries. The metadata also exposes the provenance question honestly: a post date by the group, an indexing date by HIBR, and an attribution confidence score that is an estimate, not a verdict. A name on a leak site is a claim until the dataset itself supports it.

The general reading

If you are a person, a stealer log means "someone can be you online". A breach means "your password and e-mail are on a list". A ransomware leak means "a company that held your contract, your health record, your payslip or your delivery address lost the file cabinet", and you did nothing wrong and cannot fix it by changing a password.

If you are a company, the three become one chain. A stealer log on an employee's laptop gives the attacker a VPN login or a session. That is one way ransomware intrusions can start. A year later, the same company's documents are the leak. Corporate e-mail addresses can appear in all three.

This is why ransomware leaks matter most: they are the only one of the three that comes from inside the organisation's own systems (file shares, HR, finance, mailboxes), where the volume of documents is far richer, and where the victims include people who never had an account anywhere.

What the API does not measure

• The stealer endpoint is a separate dataset from the 30-day breach and leak window. The 216 logs are a sample from the first result pages of four country searches, not a random sample of all stealer data, and the number of hits a search reports is not the number of infected devices.
• The percentages for Discord, Steam, Instagram and wallets mean the item appears in the log's file list, cookies or credentials, not that the account was compromised.
• The metadata does not give size in GB, number of files, or number of affected individuals.
• File-type counts are record counts per type, not file counts.
• The identity-document detector found 721 identity documents in 6 ransomware-leak sources and 2,374 in 12 traditional-breach sources. Identity documents are therefore not what separates the two. We do not use them as evidence of depth.
• Leak-site claims (group names, ransom amounts, data volumes) are the groups' own statements.

Check your exposure

Whether it came from an infected laptop, a forgotten website or a company you trusted, the first step is the same: find out. Search HaveIBeenRansom for your e-mail or your company's domain, and see which of the three kinds of exposure it appears in.