The ArtHouse Cloud COMBO Leak Quietly Surfaced: 14.5M Records Exposed

HEROIC analysts identified a massive combolist file, labeled "ArtHouse Cloud COMBO APR_part_005," that was uploaded to a public Telegram channel on May 10, 2026. This single file alone contained 14,557,529 records, each pairing an email address with a plaintext password and the website URL where the login was used. A dump of this size, quietly circulating in a Telegram group, is the kind of asset that criminal groups build entire automated attack campaigns around.

Why the ArtHouse Cloud COMBO Dump Is So Dangerous

With over 14.5 million plaintext credential pairs in one file, an attacker doesnt need any special tools or hacking skill to use it. They can feed the entire list directly into automated login bots and test every email and password combination against hundreds of popular websites in minutes. Because the passwords were never hashed, there is no cracking step involved, the credentials are usable the moment they are downloaded.

What Was Exposed in APR_part_005

• 14,557,529 email addresses
• Plaintext passwords paired with each email
• URLs showing which site or service each login was used on

Why This Matters to You

A combolist this large almost certainly touches accounts belonging to millions of ordinary people who have no idea their information is circulating. If your email and password happen to be inside, criminals can use them for credential stuffing attacks, trying the same login across banking, email, and shopping sites in hopes you reused it somewhere. That single point of failure is often all that stands between a hacker and full account takeover, financial fraud, or identitiy theft.

How This Stealer Log Was Assembled

Stealer logs come from malware that infects a victim's device and quietly collects saved browser passwords, autofill data, and login URLs before sending everything back to the attacker. Criminals then sort and combine the results from thousands of infected devices into one giant, organized combo file. The "APR_part_005" label suggests this dump is just one piece of a much larger series being distributed on Telegram.

Check If You Are Affected

With more than 14.5 million credentials exposed in this dump alone, the odds that your email is somewhere in the mix are higher than you might think. HEROIC's free breach scanner checks your email against a database of over 400 billion leaked records, including dumps like this one, so you can find out in seconds and take action before criminals do.