The DaisyCloud Log Leaked in June. 186,046 Passwords Are Now Exposed.

HEROIC analysts came across a stealer log uploaded to a Telegram channel on June 30, 2025. The file contained 186,046 records, including email addresses, plaintext passwords, and URLs, and carried an internal file name referencing "DaisyCloud." That name appears to be a tag applied by the uploader rather than confirmation that a specific company was breached.

Why This Is Dangerous

The passwords in this file were not taken from a hacked server. They were copied directly off infected computers by malware, in plain, unencrypted text. That means the credentials in this log work exactly as typed, giving anyone who downloads the file an immediate way into the accounts they belong to.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each set of credentials

Why This Matters

With 186,046 working email and password pairs now circulating, this log is exactly the kind of material attackers use for credential stuffing, quickly testing stolen logins against banking, email, and retail sites to see which ones still work. Anyone who reused a password caught in this leak faces a real risk of account takeover, financial fraud, or identity theft.

How Stealer Logs Work

This kind of file is generated by infostealer malware, which typically spreads through pirated software, cracked games, or disguised downloads. Once installed on a device, it reads saved passwords and autofill data straight out of the browser and packages them into a log file. That log then gets shared or sold on Telegram channels, often within days of the initial infection, which is why logs like this one can appear and spread quickly before most victims even know their device is compromised.

Check If You Are Affected

HEROIC's free breach scanner lets you check your email address against a database of more than 400 billion leaked records, including stealer logs like this one. If your information turns up, resetting that password everywhere you used it is the quickest way to cut off an attacker's access.