The ArtHouse Cloud Logs v3 Leak Contains Exactly 21,978 Login Pairs

HEROIC analysts identified a stealer log dataset called ArtHouse Cloud Logs v3 that was uploaded to a Telegram channel on July 20, 2026. The file contained exactly 21,978 records made up of email addresses, plaintext passwords, and the URLs those credentials were used on. Why This Is Dangerous: Because every password in this file was stored and leaked in plaintext, an attacker can use each credential the moment they open the file, with no cracking or guessing required. The matching URL tells them exactly which site the login belongs to, so testing the credential takes seconds. What Was Exposed: - Email addresses - Plaintext passwords - URLs identifying the account each password unlocks Why This Matters: A precise count like 21,978 working logins is exactly the kind of list attackers use for credential stuffing, feeding stolen email and password pairs into automated tools that test them against banking sites, email providers, and online stores. If you reuse a password anywhere in this file, the risk is not hypothetical, it is a direct path to account takeover, financial fraud, and identity theft. How a Stealer Log Like This Works: A stealer log is generated when malware silently infects a device, pulls saved passwords and autofill data straight out of the browser, and sends everything back to whoever is running the malware. That operator then bundles the harvested logins, in this case 21,978 of them, into a file like ArtHouse Cloud Logs v3 and distributes it through Telegram channels, making it available to other attackers almost as soon as it is collected. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer logs like this one, so you can find out in seconds if your credentials are part of the 21,978 exposed here. Run a free scan today and change any password you've reused elsewhere.