The ArtHouse Cloud Logs v1 Leak Exposed 46,654 Login Credentials

HEROIC analysts discovered a stealer log called "New ArtHouse Cloud Logs v1" uploaded to a Telegram channel on July 19, 2025. The file exposed 46,654 records tied to U.S. users, including email addresses, plaintext passwords, and the API host URLs those credentials were used to log into.

Why This Cloud Log Leak Is Dangerous

The passwords in this file were stored in plaintext, meaning anyone who gets hold of the log can use the credentials immediately without needing to crack or decode anything. Because each password is paired with the specific URL it unlocks, attackers can go straight to the source and attempt to log in.

What Was Exposed in the ArtHouse Cloud Logs v1 Leak

• Email addresses
• Plaintext passwords
• API host URLs linked to each account

Why This Matters

With 46,654 sets of working credentials in circulation, this data is valuable for credential stuffing attacks, in which stolen logins are tested against other websites and cloud services. Anyone who reused a password from this leak on another account faces a heightened risk of account takeover, and any personal or business data stored behind those cloud endpoints could be exposed to further theft.

How Stealer Logs Like This One Get Created

Stealer logs are produced by malware that infects a device and silently collects saved passwords, browser autofill entries, and active login sessions. The stolen data is bundled into a log file, like the one labeled "New ArtHouse Cloud Logs v1," and then shared or sold through Telegram channels, exactly how this file came to light on July 19, 2025.

Check If Your Email Was Exposed

If you use cloud services and want to know whether your login details appear in this or any other leaked stealer log, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a scan now to find out and get guidance on which passwords to update.