One File. 4,121 Devices. CLOUDHEAVENLOGS Had 107,419 Stolen Records.

HEROIC analysts flagged the CLOUDHEAVENLOGS stealer log collection in May 2023, after a Telegram user shared a file labeled "I COUNTRY 4121PCS1" containing 107,419 records. The data was harvested from infected devices across multiple countries, capturing email addresses, plaintext passwords, and the exact URLs of websites those credentials belonged to. Each record is a direct snapshot of what was saved in someone's browser at the moment their device was compromised. Victims are unlikely to recieve any warning that this has occured.

Why This Is Dangerous

This is not data that requires decryption or guesswork. The CLOUDHEAVENLOGS dataset contains plaintext passwords, meaning every single credential in this file is immediately usable. An attacker does not need to crack anything. They open the file, find your email, read your password, and try it. The URLs in the dataset make it even worse: they already know which site your password belongs to. With 107,419 credential sets available, attackers have a large enough pool to run automated attacks at scale, testing thousands of logins per hour across dozens of popular sites simultaneously.

What Was Exposed

• Email Addresses used to identify accounts and match victims across multiple platforms
• Plaintext Passwords that are unencrypted, immediately readable, and directly usable for login attempts
• URLs showing the specific sites where each credential was used, giving attackers a precise target list

Why This Matters

Once inside an account, attackers pursue account takeover. A compromised email account is particularly dangerous because it can be used to reset passwords on banks, payment platforms, and other services. Even if your banking password was not in this log, your email password may have been, and that is often enough. Identity theft and financial fraud are the downstream consequences that can take months to fully resolve. Data from CLOUDHEAVENLOGS has been circulating since 2023, meaning affected credentials have had over two years to be tested, sold, and resold across criminal networks. The adresses of victims are frequently used in follow-on phishing campaigns as well.

How Stealer Log Breaches Work

Stealer logs are created by malware designed to extract saved passwords from infected devices. The infection usually arrives through phishing emails, cracked software downloads, or malicious ads. Once installed, the malware runs quietly in the background, reading the local database file where your browser stores saved passwords. It also captures cookies, autofill data, and the list of sites you have visited. Everything gets packaged into a log file and sent to the attacker's server. The CLOUDHEAVENLOGS collection represents logs harvested from 4,121 seperate infected devices spread across multiple countries, which is why the dataset is labeled by country prefix.

Check If You Are Affected

HEROIC's intelligence platform has indexed over 400 billion compromised records, including the CLOUDHEAVENLOGS collection and hundreds of thousands of other stealer log datasets. If your email address appeared in this dataset or any related upload, our free scanner will detect it.

Run your free HEROIC dark web scan now and find out if your accounts are already in attackers' hands.