The ArtHouse Cloud Logs Leak Exposed 75,717 Email Logins

In late January 2025, HEROIC analysts identified a stealer log file circulating on a public Telegram channel under the label "ArtHouse Cloud Logs." The file, dated January 25, 2025, contained 75,717 individual records harvested from infected computers, each one pairing an email address with a plaintext password and the web address (URL) where that login was used. "ArtHouse Cloud" is simply the name the uploader gave this batch of stolen data, not the name of a company that was hacked. The people affected are everyday users of many different websites whose login details were quietly stolen by malware running on their own devices.

Why the ArtHouse Cloud Logs Leak Is Dangerous

What makes this leak especially risky is that the passwords were stored and exposed in plaintext, meaning no encryption or hashing stood between an attacker and a working credential. Anyone who downloads this file can immediately try each email and password pair against the site listed in its URL, and against dozens of other popular services, without cracking or guessing a thing. If any of the 75,717 people in this file reused a password on more than one account, every one of those accounts is now at risk.

What Was Exposed in the ArtHouse Cloud Logs Leak

• Email addresses tied to real user accounts
• Plaintext, unencrypted passwords
• URLs showing which websites or services each login belonged to

Why This Matters

Stolen email and password pairs like these are the raw material for credential stuffing attacks, where automated tools rapidly test the same login against banking sites, email providers, social media, and shopping accounts. Because so many people reuse passwords, a single stealer log can lead to account takeover, hijacked email accounts used to reset other passwords, unauthorized purchases, and ultimately identity theft. Plaintext passwords remove the last line of defense that normally slows an attacker down.

How a Stealer Log Like This Gets Created

A stealer log is the output of infostealer malware, malicious software that quietly infects a victim's computer, often through a fake download, cracked software, or a malicious attachment. Once installed, it scans the browser's saved logins and autofill data, bundles everything it finds into a text file, and sends it back to the attacker. That file is later sold, traded, or in this case simply uploaded to a Telegram channel for anyone to take for free. Because the malware harvests whatever the browser has saved, a single infected computer can leak dozens of accounts at once, which is how a log like this reaches tens of thousands of records.

Check If You're Affected

If you think your information could be part of the ArtHouse Cloud Logs leak or any other breach, HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one. Run a free scan to see what has been exposed, and if you find a match, change that password immediately and turn on two-factor authentication wherever it's offered.