The ArtHouse Cloud Logs v2 Breach Gave Hackers Everything They Need to Access Accounts

HEROIC analysts identified a stealer log dataset uploaded to Telegram in March 2026, labeled ArtHouse Cloud Logs v2, that exposed 57,738 records. The file contained email addresses, plaintext passwords, and URLs collected from compromised devices through information-stealing malware. The "v2" designation suggests this was a second release in an ongoing series, meaning earlier batches of this data may have already been circulating in criminal channels before this upload surfaced.

What Attackers Can Do With 57,738 Plaintext Credentials

Plaintext passwords require no cracking. An attacker who downloads this file can load every email-and-password pair directly into an automated tool and begin testing them against login pages across the internet within minutes. Cloud storage services, email providers, financial platforms, and workplace tools are all common targets. Because the dataset also includes URLs showing exactly which sites the credentials were captured from, attackers do not even need to guess where to start. They already know which accounts are worth prioritizing.

What Was Exposed in the ArtHouse Cloud Logs v2 Leak

• Email Addresses
• Plaintext Passwords
• URLs (the specific sites where credentials were stolen)

Why This Matters for Credential Stuffing and Account Takeover

Datasets like ArtHouse Cloud Logs v2 are the fuel behind credential stuffing attacks, where criminals run stolen username-and-password pairs against dozens of services at once until they find one that works. With nearly 58,000 records, this file gives attackers a meaningful volume of real, working credentials to cycle through. Successful account takeovers can lead to unauthorized purchases, fraudulent wire transfers, exposure of private communications, and identity theft if the attacker pivots from a compromised email account to reset passwords on banking or government services.

How ArtHouse Cloud Logs Were Created Through Stealer Malware

The name "ArtHouse Cloud Logs" refers to how the malware operator organized their harvested data, not necessarily a specific website or company. Information-stealing malware typically infects a device through a phishing link, a trojanized software download, or a malicious browser extension. Once active, it silently extracts saved passwords from browsers like Chrome and Firefox, captures credentials entered into login forms, and records session cookies that can be replayed to bypass two-factor authentication. The malware then uploads all of this to a remote server. Operators package these logs into collections and distribute them, either for sale or, as in this case, for free on Telegram. The second version of this log set suggests the operator ran an extended campaign and released data in multiple waves.

Check If Your Email Appears in the ArtHouse Cloud Logs

If your device was infected at any point before March 2026, your credentials may have ended up in this dataset or others like it. HEROIC's free breach scanner checks your email address against more than 400 billion records, including stealer log collections distributed through Telegram and dark web forums. Run a free search now to see whether your information has been exposed and take action before an attacker does.