ArtHouse Cloud Logs Breach Leaks 41,005 Passwords

HEROIC analysts flagged a stealer log named "ArtHouse Cloud Logs" uploaded to Telegram, with a collection date of 1 February 2026. The file held 41,005 records, each combining an email address, a plaintext password, and the URL of the site the login was used on.

Creative and Digital Industry Accounts at Risk

The name and structure of this log suggest a strong overlap with creative tools and cloud-based platforms, the kind of software used by designers, marketers, and digital agencies every day. When malware targets a device used for creative work, it often scoops up logins for portfolio sites, cloud storage, project management tools, and client billing platforms all at once.

Freelancers and small creative studios are especially exposed because they frequently store client passwords and payment logins in the same browser profile used for personal accounts.

Why This Is Dangerous

Since these passwords sit in plaintext, there's no cracking required. An attacker can lift a login straight from the file and try it immediately, gaining access to accounts that may hold client data, invoices, or creative assets.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the affected websites

Why This Matters

Stolen credentials like these fuel credential stuffing attacks across dozens of platforms at once. For freelancers and agencies, this can mean account takeover of client-facing tools, identity theft, or fraudulent invoices sent under a victim's name.

How Stealer Logs Work

Malware infects a device through a bogus plugin, a cracked design asset, or a phishing email, then silently reads every saved password and autofill field in the browser. The results get compiled into a log file, which is then circulated in Telegram channels like the one HEROIC's team monitored to find this leak.

Check If You Are Affected

Whether you freelance, run a studio, or just use cloud tools day to day, it's worth checking. HEROIC's free scanner searches over 400 billion breached records, including logs like ArtHouse Cloud Logs, to tell you instantly if your credentials were expossed.