Cloud and Financial Account Holders Targeted in the 24,910 Record cvv190_cloud Breach

In March 2026, HEROIC analysts verified a stealer log file uploaded to Telegram under the name cvv190_cloud. The file exposed 24,910 records, making it one of the larger verified stealer logs in recent months. Each record contains an email address, a plaintext password, and the URL of the service where that credential was captured. The name of the file, referencing CVV and cloud services, suggests a deliberate focus on financially valuable and cloud-hosted accounts.

With nearly 25,000 records and all passwords in plaintext, the cvv190_cloud log represents a significant and immediately actionable threat to everyone whose data appears in it. No decryption, no cracking, no additional enrichment required. An attacker with this file can begin testing accounts right away.

What the cvv190_cloud Stealer Log Exposed

• Email Addresses: Full email account identifiers linked to every compromised record
• Plaintext Passwords: Unencrypted passwords captured directly from infected devices and browser stores
• URLs: The specific login portals, cloud service endpoints, and financial platforms where each password was stolen

Who Is Targeted in the cvv190_cloud Stealer Log

The cvv190_cloud file name is not accidental. CVV references in threat actor naming conventions typically signal an interest in payment card data, financial accounts, or services that store billing information. Combined with the cloud focus, this log appears to have targeted users of cloud platforms that handle financial transactions, subscription billing, or stored payment methods.

That makes the 24,910 people in this dataset particularly vulnerable. Users of cloud-based financial tools, e-commerce platforms, SaaS services with stored payment methods, and accounts linked to payment processors are all at elevated risk. An attacker with access to a cloud account that stores billing data can make unauthorized purchases, export stored card details, or use the account to launder transactions.

Beyond financial fraud, the 24,910 email and password pairs in this file are raw material for large-scale credential stuffing. Every major platform, including email providers, social networks, and banking apps, becomes a potential target the moment this file circulates. Identity theft is the natural consequence when an attacker gains access to a primary email account and begins using it to reset passwords on linked services.

How Stealer Logs Targeting Cloud and Financial Accounts Are Built

The malware that produces files like cvv190_cloud is specifically engineered to harvest the credentials most likely to have financial value. It does not indiscriminately grab everything on a device. Modern stealers are tuned to prioritize browser-saved passwords for financial platforms, cloud services, and any site that matches known patterns for payment processing or subscription management.

Once a device is infected, typically through a phishing campaign, a cracked software download, or a malicious browser extension, the malware begins extracting saved credentials and session cookies. It packages everything into a structured log file organized by URL. The log is then exfiltrated to an attacker-controlled server and eventualy shared or sold through underground networks like the Telegram channel where cvv190_cloud surfaced.

Victims recieve no warning when their credentials are taken this way. The breach occured on their own device, outside the visibility of any company's security systems. The first indication many people have is an unauthorised charge or an account they can no longer access.

Scan Your Email Against the cvv190_cloud Log for Free

HEROIC's breach database indexes more than 400 billion records, including verified stealer logs like cvv190_cloud and thousands of other credential files sourced from dark web channels and underground forums. A free search on our platform will tell you immediately whether your email appeared in this breach.

If your email comes back as a match, start with the account identified in the URL field from the log and work outward. Change the password on that service, then audit every other platform where you've used the same combination. Enable two-factor authentication everywhere that offers it. For any accounts linked to payment methods, review recent transaction history for unauthorized activity. Acting within hours of a confirmed breach match dramatically reduces the damage an attacker can do with stolen credentials.