57,416 Records Exposed in ArtHouse Cloud Logs v2 Data Breach

HEROIC analysts identified a stealer log dump known as ArtHouse Cloud Logs v2, uploaded to a Telegram channel on June 12, 2026. The file contains 57,416 records harvested directly from infected computers, including email addresses, plaintext passwords, and the exact URLs those credentials unlock. Unlike a typical corporate breach, this data was not stolen from a single company's server. It was collected quietly, one infected device at a time.

Why the ArtHouse Cloud Logs v2 Leak Is Dangerous

What makes this leak especially risky is the pairing of passwords with the exact login pages they belong to. Attackers don't have to guess which site a password goes with or crack any encryption. The credentials sit in plaintext, ready to be copied and pasted straight into a login form. That removes almost every obstacle between a criminal and a compromised account.

Because the data came from malware running on someone's own device, it can also include other saved logins, autofill details, and browsing habits. A single infected machine can hand over access to email, banking, work tools, and social media all at once.

What Was Exposed in This Breach

• Email addresses
• Plaintext passwords
• URLs linked to each set of stolen credentials

Why This Matters for Everyday Users

Reused passwords are the biggest risk here. If any of these plaintext credentials match a password used on another account, attackers can attempt credential stuffing, automatically trying the same email and password combination across banking, shopping, and email platforms until one succeeds.

A successful login often leads straight to account takeover. From there, criminals can change recovery details, lock out the real owner, and begin identity theft or financial fraud using saved payment methods, personal details, and connected apps.

How Stealer Log Breaches Happen

Stealer logs come from infostealer malware, a type of infection that quietly runs in the background of a victim's computer or phone. Once installed, usually through a fake download, cracked software, or malicious email attachment, it scans the browser for saved passwords, autofill data, and session cookies.

The malware then packages everything it finds into a single log file and sends it back to the attacker. These logs are frequently resold or dumped for free on Telegram channels and dark web forums, which is exactly how ArtHouse Cloud Logs v2 seperated itself from the device it was stolen from and ended up circulating publicly.

Check If You Are Affected

The fastest way to know if your information appears in this leak or any other breach is to run a free scan with HEROIC's breach checker. It searches across a database of more than 400 billion leaked records, including stealer logs like this one, so you can recieve a clear answer and take action before criminals do.