3,781 US Accounts Exposed in the Bugatti_Cloud Stealer Log Leak

In late April 2024, HEROIC analysts identified a stealer log file, labeled Bugatti_Cloud Bugatti_Man 27.04.part03, being shared on a Telegram channel. The file contained 3,781 records tied to US-based accounts, including email addresses, plaintext passwords, and the URLs of the sites those credentials were used on. Why This Is Dangerous: Unlike a typical database leak, a stealer log pairs each password directly with the website it belongs to, so an attacker does not have to guess where a stolen login works. Because the passwords in this file are stored in plaintext, there is no encryption to crack, meaning anyone who gets a copy of this log can plug the credentials straight into the matching site. What Was Exposed: the file includes email addresses used to sign into accounts, plaintext passwords tied to each email, and URLs identifying the exact websites the credentials were captured from. Why This Matters: if any of these 3,781 people reused the exposed password on other accounts, such as email, banking, or social media, an attacker can attempt credential stuffing to break into those accounts too. Because the log links each password to a specific URL, account takeover can happen quickly, sometimes leading to identity theft or financial fraud if the affected site involves payment or personal information. How This Stealer Log Was Likely Created: stealer logs come from malware that infects a victim's device, often through a fake download, cracked software, or malicious email attachment. Once installed, the malware quietly collects passwords saved in the browser, autofill data, and the web addresses tied to each login, then sends everything back to the attacker. These logs are frequently packaged and shared or sold in Telegram channels like the one where this file surfaced. Check If You Are Affected: if you think your information could be part of the Bugatti_Cloud stealer log or any other leak, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, so you can find out quickly and take action to secure your accounts.