US Accounts Targeted in the ArtHouse Cloud Logs Leak of 1,410

ArtHouse Cloud Logs Leak Exposes 1,410 US Accounts

HEROIC analysts identified a stealer log file uploaded to a public Telegram channel on July 2, 2025, containing 1,410 records tied to United States accounts. The log, labeled "ArtHouse Cloud Logs," exposed email addresses, plaintext passwords, and API host URLs harvested directly from infected devices.

Why This Is Dangerous

Because the passwords in this log were captured and stored in plaintext, anyone who obtains the file can log directly into the affected accounts without cracking or decrypting anything. The URLs recorded alongside each password reveal exactly which service each login unlocks, making it simple for an attacker to move from one compromised account to the next.

What Was Exposed

• Email addresses
• Plaintext passwords
• API host URLs (the services each login connects to)

Why This Matters

With 1,410 sets of credentials exposed in plaintext, this log gives attackers a ready-made list for credential stuffing, testing each stolen email and password combination against banking sites, email providers, and other services. Anyone in this group who reused a password elsewhere faces real risk of account takeover, identity theft, and financial fraud.

How Stealer Logs Work

A stealer log is generated by information-stealing malware that infects a device, often through a malicious download, cracked software, or a phishing link, and silently harvests saved passwords, browser data, and visited URLs. That stolen information is sent back to whoever controls the infection, then packaged into a log file and shared, in this case uploaded to a public Telegram channel where anyone can access it. Because the theft happens directly on the victim's device, it bypasses the security defenses of the websites and services themselves.

Check If You Are Affected

If you want to know whether your email address is part of this stealer log or any of the thousands of similar breaches HEROIC tracks, use HEROIC's free breach scanner to check it against a database of more than 400 billion leaked records. It takes only seconds, and it lets you change any reused passwords before someone else uses them first.