ArtHouse Cloud Stealer Log Breach: 13,738 US Records

ArtHouse Cloud: 13,738 US Credentials Released One Day Before the Oct 6 Surge

October 5, 2023 was not as headline-grabbing as October 6 -- the day when over 853,000 US stealer log credentials flooded Telegram in a single extraordinary surge. But Oct 5 was not quiet. ArtHouse Cloud was among the operators who released credentials the day before, contributing 13,738 US stealer log records to a dataset that would only grow more massive the following morning. Whether Oct 5 and Oct 6 are connected by a shared upstream event or simply represent the natural tempo of a hyperactive infostealer marketplace in early October 2023 remains an open question.

ArtHouse Cloud (October 2023): Stealer Log Summary

• Records Exposed: 13,738
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 5, 2023

ArtHouse Cloud and the NEW ArtHouse Cloud Pair

ArtHouse Cloud did not release alone on October 5. A second batch, labeled "NEW ArtHouse cloud," appeared on the same date with 17,604 records -- a larger companion release. Together, the two batches total 31,342 records across what appears to be the same operator infrastructure. The "NEW" prefix on the second batch is a common naming convension in Telegram stealer log channels, typically indicating either a refreshed collection, a different source region within the same harvest, or simply a sequential release from the same underlying botnet. Both batches target US endpoints and share the same data format: email addresses, plaintext passwords, and API host URLs.

Stealer Logs on October 5: The Day Before the Storm

The October 6, 2023 cluster -- now confirmed at 853,000+ records -- has drawn significant analytical attention as the largest known single-day infostealer event in this dataset. But the Oct 5 activity documented here suggests the infrastructure supporting that event was already operational the day before. ArtHouse Cloud's Oct 5 release, alongside CRYPTON_LOGS 2.0 and SNATCH_CLOUD, indicates multiple operators were actively publishing credentials in the 24-hour window leading up to the Oct 6 surge. This temporal clustering -- with operators releasing on both Oct 5 and Oct 6 -- may reflect a coordinated promotional period rather than truely independant events.

13,738 Plaintext Credentials and the Credential Stuffing Risk

Every record in ArtHouse Cloud's Oct 5 batch follows the same high-risk format: an email address, a plaintext password captured directly from a browser session or autofill store, and a URL indicating what service or endpoint the credential was associated with. There is no hashing, no encryption, no cracking step. The credentials arrived ready to use. An operator who accessed this channel on October 5, 2023 had 13,738 US account credentials available for immediate testing against banking portals, email platforms, social networks, and corporate VPNs -- a risk that remains active for any affected user who has not since changed their passwords.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including ArtHouse Cloud's October 5 collection and thousands of other stealer log batches. Run a free scan at HEROIC's breach scanner to determine whether your credentials have been compromised.