ArtHouse Cloud Users Targeted: 4,116 Passwords Leaked Online

HEROIC analysts found a stealer log labeled "ArtHouse Cloud Logs v1" that surfaced on a Telegram channel on June 30, 2026. The file contained 4,116 records, each one pairing an email address with a plaintext password and the exact login URL tied to it. The name suggests the credentials were pulled from users of a cloud storage or creative asset platform, meaning the people affected could be freelancers, designers, or small studios storing client work online.

Why ArtHouse Cloud Users Are a Target Worth Watching

Freelancers and creative businesses often store years of client files, contracts, and payment details in cloud storage accounts, making them an appealing target even though they may not beleive they are a likely victim. An attacker who logs into one of these 4,116 accounts could download client work, hold files for ransom, or use the stored contact information to impersonate the account owner in future scams.

What Was Exposed in the ArtHouse Cloud Logs v1 Dump

• Email addresses tied to ArtHouse Cloud accounts
• Plaintext passwords with no encryption applied
• The exact login URLs each credential opens

Why This Matters Even for a Smaller Leak

A leak of 4,116 records may look modest next to breaches with millions of rows, but size does not determine damage. If any of these users reused thier password on a personal email or banking site, the same credential can unlock accounts well beyond the original cloud service. This is exactly how a small stealer log turns into credential stuffing attacks, identity theft, and financial fraud across totally unrelated platforms.

How a Stealer Log Like ArtHouse Cloud Logs v1 Is Made

Infostealer malware infects a device, usually through a cracked app or malicious email attachment, then silently pulls every saved password and autofill entry out of the browser. Because the malware also grabs the associated login URL, criminals can filter the results by platform, which is likely how this batch of ArtHouse Cloud credentials got seperated out and packaged into its own file before being shared on Telegram.

Check If You Are Affected by the ArtHouse Cloud Leak

Whether or not you recognize the name ArtHouse Cloud, it is worth checking your own exposure since so many people reuse the same login everywhere. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can see instantly if your email and password showed up in this dump or any other.