US Accounts Hit Hardest in ArtHouse Cloud Logs v1 Breach

In January 2026, HEROIC analysts uncovered a stealer log named ArtHouse Cloud Logs v1 uploaded to Telegram, with 13,104 records tied predominantly to United States based accounts. Each record paired an email address with a plaintext password and the login URL where it was captured.

A US-Focused Leak: ArtHouse Cloud Logs v1

While stealer logs often contain a mix of victims from around the world, this particular file skews heavily toward accounts based in the United States. That regional concentration matters, since it means American consumers, remote workers, and small businesses make up the bulk of those exposed in this leak.

Attackers frequently target logs like this because US-based accounts are often linked to widely used banking apps, major email providers, and popular shopping platforms, all of which make stolen credentials more valuable on the underground market.

Why This Is Dangerous

The passwords in this file are stored in plaintext, meaning anyone who downloads the log has immediate, ready-to-use login credentials. There is no encryption to break through and no delay between finding the data and using it.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

For US consumers in particular, reused credentials are frequently tested through credential stuffing against major banks, retailers, and email services. When that succeeds, it leads to account takeover, and often escalates quickly into identity theft or financial fraud, since so many US financial institutions rely on email-based account recovery.

How Stealer Logs Work

Stealer malware infects a device silently, commonly disguised as pirated software, a game mod, or a fake browser update. Once active, it collects saved passwords, cookies, and autofill data, then bundles everything into a log file exactly like this one.

These logs are uploaded to Telegram channels where they are traded freely among cybercriminals. Because the credentials are pulled from real, active sessions, they tend to be unusually reliable, which is part of why logs concentraded around a single country like this one are especially prized.

Check If You Are Affected

If you are based in the United States, it is worth checking your exposure directly. HEROIC's free breach scanner searches a database of more than 400 billion exposed records, including US-heavy stealer logs like ArtHouse Cloud Logs v1, in just seconds.