135 Endpoint Packages: HeavenLogsCloud Peru Breach Exposes 1,294

HEROIC analysts uncovered a stealer log collection from April 2023 in which a Telegram user distributed 1,294 compromised records sourced from Peru-based endpoints. Catalogued under the name PE-PERU-135PCS-HEAVENLOGSCLOUD, the dataset contained email addresses, plaintext passwords, and URLs harvested by infostealer malware from infected machines across Peru. The volume of this single upload, 135 endpoint log packages, reflects an active and organized credential-harvesting operation targeting the region.

Why This Is Dangerous

With 1,294 plaintext passwords in hand, attackers can immediately begin testing credentials across dozens of online services without any need for password cracking. The accompanying URLs reveal the exact platforms victims were using, allowing attackers to prioritize high-value targets such as banking, government, and enterprise systems. Peru-based users of major email providers, cloud services, and social networks are all in scope for rapid account takeover attempts.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (identifying services and platforms accessed by victims)

Why This Matters

A dataset of this size provides attackers with enough material to run automated credential stuffing campaigns across multiple platforms. Each victim who reuses passwords across accounts faces exponentially greater risk, as a single confirmed credential can unlock banking, shopping, workplace, and personal accounts simultaneously. Beyond direct financial fraud, stolen credentials are frequently resold on dark web markets, extending the window of exploitation long after the initial breach.

How Stealer Logs Work

Stealer log campaigns begin with the silent delivery of infostealer malware onto a victim's device, typically through phishing links, trojanized software, or compromised browser extensions. The malware immediately begins harvesting saved credentials, browser session tokens, and autofill data. Each infected machine, or endpoint, generates a log file containing all captured data. In this case, 135 such endpoint packages were bundled and uploaded to a Telegram channel, making the stolen data available to any member of that community. The entire theft-to-distribution chain can be completed within hours, long before victims receive any notification.

Check If You Are Affected

If you used online services from a Peru-based device or network around April 2023, your credentials may be part of this collection. HEROIC's free breach scanner searches a database of more than 400 billion compromised records to determine whether your email address appears in known breach data. Run a free scan now to find out if you need to take action.