ArtHouse Cloud Logs v2 uploaded by a Telegram User

We noticed a significant data exposure event originating from a stealer log file uploaded to Telegram on January 11, 2024. This incident, dubbed "ArtHouse Cloud Logs v2," has impacted a substantial number of records, specifically 96,715 distinct entries. What struck us as particularly concerning is the inclusion of plaintext passwords alongside email addresses and URLs, presenting a direct and immediate threat vector for account compromise. The nature of the data suggests a compromise of user credentials for accessing cloud-based services or applications, making this a high-priority investigation.

The breach breakdown reveals a stealer log file, uploaded by an unidentified Telegram user, containing a comprehensive dataset of compromised endpoint information. This data includes email addresses, API hosts, and critically, passwords stored in plaintext. The structure of the leaked data points towards the exfiltration of credentials from compromised machines or applications, likely through malware designed to harvest such sensitive information. The 96,715 records represent a broad spectrum of potential targets, and the direct exposure of plaintext passwords significantly lowers the barrier for attackers to gain unauthorized access to associated accounts and services. The leak locations are primarily within the stealer log itself, indicating direct data exfiltration rather than a breach of a specific company's database.

While specific news coverage or extensive OSINT on this particular Telegram upload is nascent, the broader threat landscape of credential stuffing attacks fueled by stealer logs is well-documented. Security researchers consistently highlight the prevalence of such data appearing on dark web forums and public sharing platforms. The presence of plaintext passwords in such logs is a recurring theme in reports from organizations like Malwarebytes and Mandiant, underscoring the persistent effectiveness of these attack vectors against users who reuse credentials or employ weak password practices.