ArtHouse Cloud Leak: 14,558,140 Accounts at Risk

HEROIC uncovered a colossal stealer log archive labeled ArtHouse Cloud COMBO APR_part_010 being distributed on Telegram in May 2026. With 14,558,140 compromised credential records, this represents one of the most massive single stealer log collections HEROIC has ever indexed. The scale of this breach means that millions of people across the globe have had their login credentials exposed and made freely available to criminals.

14.5 Million Passwords with Zero Protection

Every password in this enormous dataset was captured and stored in plaintext. No hashing, no salting, no encryption of any kind shields these credentials. At 14.5 million records, this is not just a breach; it is a vast criminal resource that can power account takeover campaigns on a global scale. Each credential is ready to be used instantly, without any need for decryption or computational effort.

What Was Exposed

• Email Addresses — over 14.5 million identifiers spanning personal, professional, government, and educational accounts worldwide
• Plaintext Passwords — login credentials in their original unencrypted form, immediately usable for unauthorized access
• URLs — the specific websites, financial portals, enterprise applications, and services from which each credential was extracted

A Catastrophic Credential Stuffing Resource

Fourteen million credential pairs represent an extraordinary weapon for credential stuffing operations. Automated attack tools can process this volume against thousands of target websites simultaneously, testing each email-password combination across banking, healthcare, retail, government, and corporate platforms. Even a fraction-of-a-percent success rate at this scale yields hundreds of thousands of compromised accounts, creating a cascade of identity theft, financial fraud, and unauthorized data access.

The Industrial-Scale Infostealer Operation Behind This Dump

A collection this large indicates a well-organized infostealer malware operation. The credentials were harvested by malware infecting devices through malicious ads, compromised software downloads, and phishing campaigns operating across multiple countries. Once on a victim's device, the malware systematically extracts browser-saved passwords, session cookies, and autofill data before transmitting everything to command-and-control infrastructure. The compiled logs are then aggregated into massive combo lists and distributed through Telegram and underground markets.

Check If Your Credentials Were Exposed

With a breach this large, the probability of being affected is substantial. HEROIC's breach scanner draws from over 400 billion indexed records to determine whether your email address or password appeared in the ArtHouse Cloud dump or any other known breach. Search now, because at 14.5 million records, your credentials may already be in criminal hands.