BlackHat_Cloud 361: 1,065,613 Passwords Leaked, Act Now

HEROIC analysts uncovered a massive stealer log dump called BlackHat_Cloud 361, uploaded to Telegram on June 28, 2025. This is not a small leak. The file holds 1,065,613 records, each one pairing an email address with a plaintext password and the exact web address that login opens.

Why BlackHat_Cloud 361 Is So Dangerous

Over a million working logins is enough to automate attacks at scale. Criminals don't need to target you specifically, they run software that tries every email and password pair from this file against banking sites, email providers, and online stores within hours of getting the file. If your credentials are in this batch, the clock is already running.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs matched to each login

Why This Matters

Plaintext storage means there is no encryption standing between an attacker and your account. Criminals who recieve a copy of this file can combine the matching URL with each password to build a ready to use attack kit for credential stuffing. Reused passwords turn a single leaked login into account takeover, drained bank accounts, and stolen identities across multiple sites at once.

How Stealer Logs Work

A stealer log is built from malware, not a hacked company database. Once malicious software infects a device, usually through a cracked program or fake download, it quietly copies every password saved in the browser along with the site it belongs to. Those records get bundled by the thousands, or in this case over a million, and sold or shared on Telegram channels, which is exactly where this leak occured and got flagged.

Check If You Are Affected

With over a million records exposed, the odds that your information is included are higher than usual. Don't wait to find out the hard way. Run your email through HEROIC's free breach scanner, which checks against a database of more than 400 billion leaked records, and see instantly if you need to change a password today.