Dark Web Intel: ArtHouse Cloud Leak Exposes 2,057,340 Logins

Dark web intel gathered by HEROIC flagged a large combo list titled ArtHouse CLoud COMBO_part_0013, uploaded by a Telegram user in February 2026. The file contains 2,057,340 records, each pairing an email, a plaintext password, and a URL from an infected device.

Why This Is Dangerous

Combo lists like this one are prized on dark web channels because theyre already formatted for immediate use, no cleanup neccessary before an attacker starts testing logins. A file labeled part_0013 also hints that this is just one piece of a much bigger series being passed around.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs from the source accounts
• 2,057,340 total records exposed

Why This Matters

Dark web intel like this gives a rare look at what is actually being traded behind the scenes, and it shows that leaks of this size are not rare, they happen regularly and quietly. For the millions of people caught up in a file like this, their credentials are alot more exposed than they probably realize.

How Combo List Leaks Work

A combo list is built the same way most stealer based leaks are, malware infects a device, scrapes saved browser passwords, and sends the data back to whoever runs the campaign. What makes it a combo list specifically is the packaging, records get compiled in bulk, sometimes in numbered parts like this one, so they are easy to distribute and definately easy to reuse.

Check If You Are Affected

With over two million records in this single part alone, checking your exposure is a smart move. HEROIC's free breach scanner searches more than 400 billion leaked records so you can see if your information turned up in this combo list or any other.