ArtHouse Cloud Leak Gives Attackers 14,553,841 Working Logins

HEROIC analysts identified a massive stealer log labeled "ArtHouse Cloud COMBO APR_part_041," uploaded to Telegram and dated 14 May 2026. The file contains 14,553,841 records, each pairing an email address with a plaintext password and the URL of the login page it unlocks. At over 14.5 million entries, this is one of the largest single stealer logs HEROIC has verified, and every one of those records is stored in plaintext, meaning no password cracking stands between an attacker and a working login.

What Attackers Can Do With the ArtHouse Cloud Leak

With 14,553,841 ready-to-use email, password, and URL combinations in one file, an attacker doesn't need to target anyone specifically. They can run automated scripts that attempt logins across all 14,553,841 records against email providers, banking sites, and online stores in a matter of hours. Because the correct login URL is already attached to each password, there is no guesswork involved, only scale.

What Was Exposed in the ArtHouse Cloud Leak

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters for Reused Passwords

A file of this size is exactly the kind of raw material that fuels credential stuffing at industrial scale. Anyone among the 14,553,841 exposed records who reused a password on another site is now a target for account takeover, and from there, identity theft or financial fraud. The sheer volume means this leak alone could touch millions of people who reused the same login somewhere else without ever knowing it.

How a Stealer Log This Large Gets Built

Stealer logs are compiled by malware that infects devices and quietly copies saved browser credentials, autofill entries, and session data. A file the size of ArtHouse Cloud, labeled as part 041 of a combo series, suggests it was assembled from many separate infections and combined into one release before being shared on Telegram or dark web marketplaces. That packaging and labeling is exactly how the ArtHouse Cloud file ended up in circulation.

Check If Your Email Was in the ArtHouse Cloud Leak

With more than 14.5 million records involved, the chances your email address is among them are worth taking seriously. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like ArtHouse Cloud, and tells you instantly if you were exposed. Run a free scan now and change any reused passwords before someone else logs in first.