ArtHouse Cloud Logs2 Data Breach: 9,274 US Credentials Exposed

ArtHouse Cloud's Double Drop: 25,937 US Credentials Across Two Same-Day Releases

Most Telegram stealer log channels release one batch and move on. ArtHouse Cloud released two on the same day. On October 9, 2023, the channel distributed ArtHouse Cloud Logs (16,663 records) and ArtHouse Cloud Logs2 (9,274 records) within hours of each other, combining for 25,937 US plaintext credentials in a single-day double release. This split-batch approach -- a primary "Logs" release followed by a secondary "Logs2" -- is a distribution pattern that suggests either sequential log sorting, a deliberate tiered release strategy, or the channel operator simply processing two seperate collections from the same malware campaign.

ArtHouse Cloud Logs2 (October 2023): Stealer Log Summary

• Records Exposed: 9,274
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 9, 2023

The Logs / Logs2 Split: What It Signals

The "Logs" and "Logs2" naming convention is a common shorthand in stealer log distribution for what amounts to two batches from the same source channel. The primary batch is typically larger -- ArtHouse Cloud Logs at 16,663 records -- while the secondary "Logs2" batch (9,274 records here) represents either overflow material, a separate collection period, or logs filtered by different geographic or quality criteria. Together they account for 25,937 US credentials, placing ArtHouse Cloud among the more prolific single-channel contributors to the October 9, 2023 distribution day.

October 9, 2023: The Cluster's Peak Day

ArtHouse Cloud Logs2 dropped on the single most active day of the October 2023 stealer log cluster. October 9 saw simultaneous releases from STARLINKCLOUD (123,997 records), xl0gs (16,083), ArtHouse Cloud Logs (16,663), ArtHouse Cloud Logs2 (9,274), TOR_LOG MIX566pcs (14,327), and numerous other channels. The sheer volume of concurrent releases suggests coordinated market activity -- multiple channel operators pushing promotional material simultaneously to maximize visibility during a high-traffic period in Telegram credential markets.

Credential Stuffing Risk From Plaintext Logs

Both ArtHouse Cloud batches contain plaintext passwords -- credentials captured live from victim machines by infostealer malware as users typed or autofilled them. Unlike hashed passwords that require cracking, these records are immediately actionable. A credential stuffing tool can test 9,274 email-password pairs against hundreds of platforms in minutes. For any victim whose password appears in ArtHouse Cloud Logs2, every account where that password was reused is potentialy compromised the moment the log enters circulation.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including both ArtHouse Cloud releases from October 9, 2023. If your email address appears in either batch, your associated plaintext password is already in circulation in underground markets. Discover your exposure at HEROIC's breach scanner and take protective action before credential stuffing attacks reach your accounts.