12,628 Accounts at Risk in the ArtHouse Cloud Logs v1 Stealer Log

Every one of the 12,628 passwords in the ArtHouse Cloud Logs v1 file was stored as plain, readable text, no cracking required. HEROIC analysts found this stealer log circulating on Telegram in September 2026, pairing those passwords directly with email addresses and the web addresses they unlocked. Scan your email to see if yours is one of them.

Why Plaintext Passwords Make This Worse

A hashed password at least slows an attacker down. A plaintext one does not, anyone who downloads this file can use the logins immediately, with no extra steps.

What the ArtHouse Cloud Logs v1 File Exposed

• Email Addresses: the account identifier tied to each stolen login.
• Plaintext Password: readable as is, ready for immediate reuse by anyone who has the file.
• URLs: the exact site each login was captured from, pointing an attacker straight to where it still works.

What This Means If You Are in the File

Because the URL travels with each login, an attacker does not need to guess where to try it, the file tells them exactly which site to target for each stolen password. That removes the trial and error that normally slows down this kind of attack, making account takeover faster and more likely to succeed.

How a Stealer Log Like This Is Made

Stealer logs come from malware that infected a device directly, quietly copying saved usernames, passwords, and the sites they belong to straight out of a browser. The device itself was compromised, not any single company.

Clean Your Device Before Changing Passwords

Scan your email to check your exposure. If you find a match, assume the device that login was saved on may still be infected, clean or reset it first, then change your passwords from a device you know is safe, starting with email and anything financial. This applies to personal and work logins alike.