2,634 Records Exposed in SunCloudNew 1643 Stealer Log Leak

2,634. That's how many individual login records showed up inside a stealer log dump called SunCloudNew 1643 - 650 LogsFile, uploaded to a Telegram channel back in March 2026. HEROIC's research team confirmed the file is real, and every one of those records ties back to an actual person's saved credentials.

Why This Is Dangerous

What makes this particular dump risky isn't just the count, it's the format. The passwords sit in plaintext, meaning there's no encryption to break through. Anyone who downloads the file can definately open it in a basic text editor and start testing logins against email providers, banks, or shopping accounts right away.

What Was Exposed

• Email addresses linked to real accounts
• Plaintext passwords with no encryption to break
• URLs identifying which sites each login belongs to
• 2,634 total records inside the SunCloudNew 1643 file

Why This Matters

A smaller record count doesn't mean smaller risk. In fact, dumps like this often get overlooked precisely becuase they seem minor next to breaches with millions of rows. Attackers know this too, and often target these quieter logs first since victims are less likely to have already changed their passwords.

How Stealer Logs Work

Stealer logs like SunCloudNew 1643 come from malware planted on a victim's machine, frequently through a pirated app or a phishing link. The malware digs through the browser's saved password vault, autofill fields, and active session cookies, then quietly ships everything to a server the attacker controls. From there, the data gets formatted into a log file and passed around on marketplaces and Telegram groups.

Check If You Are Affected

Small leak or massive one, the only way to know for sure is to check. HEROIC runs a free breach scanner against a database of over 400 billion exposed records, so you can search your email and see immediately if it turned up in this dump or any other.