ICELOGSCLOUD 6 September: 38,655 U.S. Stealer Log Credentials (Sep 2022)

The Peak of ICELOGSCLOUD: 38,655 Credentials in a Single Release

Among the ICELOGSCLOUD series of Telegram infostealer releases spanning August-September 2022, the September 6 bundle stands out by a wide margin. "6 SEPTEMBER - 778 PCS ICELOGSCLOUD" contained 778 indvidual log files -- the largest piece count in the known series -- and exposed 38,655 U.S. infostealer credential records, surpasng the next-largest release in the series by nearly 25,000 records. For buyers, this colection offered granular access to 778 individual infected devices, each one a complete snapshot of a victim's saved browser credentials at the time of infection. For the 38,655 Americans whose data was in this bundle, September 6, 2022 was the day their login credentials entered the criminal marketplace.

ICELOGSCLOUD September 6, 2022: Breach Summary

• Records Exposed: 38,655
• Data Types: Email addresses, plaintext passwords, target login URLs
• Breach Type: Infostealer malware log
• Country Affected: United States
• Date Leaked: September 6, 2022

778 Individual Device Logs: What This Means for Victims

At 778 pieces and 38,655 records, the September 6 ICELOGSCLOUD bundle averaged approximately 50 credential pairs per infected device -- significantly higher than most releases in the series, suggesting the devices in this batch had extensive browser credential stores. This could indicate a mix of consumer and enterprise devices, or simply users with many active online accounts all saved to their browsers. Each of the 778 files represents a complete victim profile: every saved login that person had on their device at the moment of infection, across banking sites, email providers, work tools, shopping platforms, and everything else they'd trusted to their browser's password manager.

The ICELOGSCLOUD Series in Context

The September 6, 2022 release was not an isolated incident. ICELOGSCLOUD distributed bundles at least four times across a five-week window: 26 AUGUST (554 pcs, 7,353 records), 6 SEPTEMBER (778 pcs, 38,655 records), 21 SEPTEMBER (371 pcs, 4,303 records), and 29 SEPTEMBER (182 pcs, 2,166 records). The September 6 peak represents the high-water mark of the channel's known output, and the decline in subsequent releases may reflect natural variation in the malware campaign's infection yield rather than any reduction in operator activity. Together, the four known ICELOGSCLOUD releases account for over 52,000 U.S. credential records distributed across a single month.

Check If Your Credentials Were Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including large-volume releases like the ICELOGSCLOUD September 6 bundle -- to tell you instantly if your email address or passwords have been compromised. With nearly 40,000 records in a single release, statistical exposure risk is significant for any American with active online accounts. Run a free scan today at HEROIC.com.