Who’s at Risk in the ArtHouse Cloud Logs v2 Leak of 21,780

In January 2026, HEROIC analysts discovered a stealer log named ArtHouse Cloud Logs v2 circulating on Telegram. The file held 21,780 records pulled from infected devices, each one pairing an email address with a plaintext password and the login URL it belonged to.

Who Is Targeted by the ArtHouse Cloud Logs v2 Leak

Stealer logs like this one do not target a single company or industry. They target whoever happens to click the wrong download link. That means everyday internet users, remote workers using cloud tools, freelancers, and small business owners are all commonly caught up in logs like this, since the malware simply infects whatever machine it lands on.

Because the leaked URLs point to a mix of everyday login pages, anyone from casual shoppers to people managing business cloud accounts could be sitting inside this particular file. There is no way to know you are affected without checking directly.

Why This Is Dangerous

Since the passwords are stored in plaintext, there is no barrier between the stolen file and a working account login. Anyone who downloads this log can try the credentials immediately, without needing to crack or decode anything first.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

Reused logins are the real danger here. Attackers routinely run credential stuffing campaigns, testing the same email and password pair across banking sites, email providers, and shopping platforms. If even one match succeeds, it can lead to full account takeover, followed by identity theft or financial fraud carried out under the victim's name.

How Stealer Logs Work

This type of leak traces back to info-stealing malware rather than a hacked server. The malware sneaks onto a device, often through a fake software crack or malicious ad, and quietly copies saved passwords, browser cookies, and autofill entries.

All of that gets compiled into a log and uploaded to Telegram, where it becomes avaliable to anyone browsing that channel. Because the data was captured from live sessions, it is often more accurate and current than older leaked password databases.

Check If You Are Affected

Whether you fit the profile of a typical target or not, it is worth checking. HEROIC's free breach scanner searches a database of more than 400 billion exposed records, including stealer logs like ArtHouse Cloud Logs v2, so you can find out in seconds if your information is at risk.