Plaintext Passwords Leaked in DAISY_CLOUD Feb 14 Breach

What Happened

On February 14, 2023, the DAISY_CLOUD Telegram channel released a stealer log pack branded as DAISY_CLOUD - 14 FEBRUARY - 100 PCS. DAISY_CLOUD runs on a steady drop schedule, publishing nearly identical packs every few days, which is why this mid-February release sits between a separate February 16 drop and a later February 20 drop from the same operator. The February 14 pack was discovered shortly after posting and preserved by dark web monitoring before Telegram moderation could remove it.

Scope of the Exposure

Although the pack is branded as 100 PCS, the archive expanded to 1,543 individual records once parsed. Each record represents credentials harvested from a single infected endpoint and lists the login URL, the account email, and the password in plaintext. Stealer log packs like this one are sold or shared freely inside the DAISY_CLOUD community and quickly move from there to broader credential marketplaces.

Types of Data Exposed

• Email addresses used to sign in to websites and apps
• Plaintext passwords captured by infostealer malware
• Login URLs showing the exact service each credential opens
• Evidence that the source device was compromised with a credential-stealing payload

Why the February 14 DAISY_CLOUD Drop Stands Out

The DAISY_CLOUD operator specializes in small, frequent drops that look unremarkable on their own but add up to massive credential volume over time. The February 14 release is distinct from the channel's February 16 and February 20 drops, meaning an affected user could appear in multiple consecutive DAISY_CLOUD packs. Because each record points to a specific service URL, attackers skip credential guessing and move straight to account takeover.

How to Check Your Exposure

The HEROIC Data Breach Engine indexes DAISY_CLOUD drops, including the February 14, 2023 release. Searching your primary email tells you whether any of the 1,543 records in this drop match your identity and whether the same email shows up in other DAISY_CLOUD releases.

What to Do If You Are Affected

• Reset the password on any account that matches a leaked credential, starting with email.
• Scan the device where credentials were stored, since stealer logs mean active malware infection.
• Enable multi-factor authentication on every account that offers it.
• Log out of all current sessions and rotate saved browser and app credentials.
• Turn on HEROIC monitoring to catch future DAISY_CLOUD and infostealer drops that reference your email.