Naz.API Data Breach (2023): What Was Exposed & What To Do

Compilations of stolen credentials continue to circulate widely on criminal forums, feeding automated attacks that test reused passwords across countless services. In that landscape, large dumps that mix stealer-log output with credential-stuffing lists remain a persistent source of risk for ordinary internet users.

In September 2023 a collection titled Naz.API, reported as containing more than 100 GB of material and affecting roughly 70.8 million people, was posted to a popular hacking forum. Public reporting describes the corpus as holding tens of millions of unique email addresses paired with passwords, making the incident consequential for anyone whose login details may have been swept into the set.

Inside the incident

According to the reported summary, over 100 GB of stealer logs and credential-stuffing lists titled “Naz.API” appeared on a popular hacking forum in September 2023. The material was described as a combination of email-address and plain-text password pairs that also recorded the service into which the credentials had been entered, together with standalone credential pairs obtained from unnamed sources. The corpus was said to include 71 million unique email addresses and 100 million unique passwords. The incident was reported on 20 September 2023 and is associated with approximately 70.8 million people affected. No further public detail has been given on the precise timing of the underlying thefts, the original intrusion methods, or any single organisation that was the sole source of the data.

How a breach like this happens

Incidents of this type typically begin with information-stealing malware that runs on compromised personal devices. Once installed—often through phishing attachments, malicious downloads or cracked software—the malware harvests saved browser passwords, form-fill data and session tokens and exfiltrates them to the attacker. Separately, credential-stuffing lists are assembled by aggregating earlier breaches and testing the resulting username-password pairs against other sites. Operators then package the raw stealer logs and the stuffing lists into large archives and advertise them on underground forums. Because the material is drawn from many unrelated victims and services, the resulting dump rarely points to a single corporate network compromise; instead it reflects the cumulative leakage of credentials from individual machines and prior incidents. No specific threat group has been attributed in the available facts for the Naz.API posting.

About Naz.API

Naz.API is the title under which the September 2023 collection was released; public reporting treats it as the label for the compiled stealer logs and credential lists rather than as a conventional operating company. Collections of this kind function as wholesale repositories of login data that criminals can search, filter and reuse. Organisations and individuals whose credentials appear inside such archives face elevated risk because the data is already formatted for automated reuse. The presence of service identifiers alongside many of the pairs further increases the practical value of the material to anyone conducting targeted stuffing or account-takeover attempts.

What data was at risk

The facts name email addresses and passwords as the exposed data types. Reporting further states that many records consisted of email-and-plain-text-password pairs accompanied by the service they were entered into, plus additional standalone credential pairs. Exact contents beyond these categories remain unconfirmed in the public record; no other personal-data fields have been listed. In general, stealer-log collections of this nature can also contain whatever else the malware captured on a given device, but only the email addresses and passwords are confirmed here.

The real-world impact

For affected individuals the primary risk is account takeover. Because the passwords appear in plain text, an attacker can attempt immediate login to the original service or to any other site where the same password was reused. Successful takeover can lead to fraudulent transactions, identity misuse, or further compromise of linked accounts. For any organisation whose users appear in the set, the consequence is an increase in credential-stuffing traffic and potential unauthorised access to customer or employee accounts. The scale—tens of millions of unique emails and passwords—means the exposure is broad rather than confined to a single breached company, so the practical burden falls on users to change passwords and on services to detect anomalous logins.

What to do if you're exposed

Change the password on every account that may have used the same or a similar credential, starting with email, banking and any service that holds payment details. Enable multi-factor authentication wherever it is offered. Monitor account statements and login notifications for unfamiliar activity. Consider using a password manager to generate and store unique passwords going forward. Readers can also run a free exposure scan of their email address to check whether their information has surfaced in known breach data and to receive guidance on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.