Cloud Customers Exposed: HESOYAM CLOUD Stealer Log Leaked 38k Records

HEROIC analysts identified this breach while scanning Telegram channels that regularly host credential dumps and stealer log packages. On September 2, 2025, an anonymous Telegram user uploaded a stealer log file tied to HESOYAM CLOUD, a cloud service provider. The file contained 38,146 records including email addresses, plaintext passwords, and API host URLs. What set this breach apart was the deliberate targeting of cloud access credentials, not just generic account logins. The data appears to have been gathered by stealer malware installed on the endpoint devices of cloud platform users.

Why This Is Dangerous

Cloud service accounts are high-value targets because they often control far more than a single inbox or profile. A compromised cloud account can expose entire storage buckets, hosted applications, databases, and internal team communications. When API host URLs are included alongside plaintext passwords, attackers gain a shortcut directly into cloud infrastructure. They bypass the front door and walk straight into the back-end. This type of access can be used to steal data, deploy ransomware, or sell the access to other criminals on underground markets.

What Was Exposed

• Email addresses belonging to HESOYAM CLOUD platform users
• Plaintext passwords with no encryption applied
• API host URLs enabling direct access to cloud back-end systems
• 38,146 total records harvested from compromised endpoints
• Data posted to a Telegram channel on September 2, 2025

Why This Matters

Cloud service breaches carry outsized consequences compared to typical consumer account leaks. A single compromised cloud account can affect dozens of downstream users, clients, or services connected to it. For businesses relying on HESOYAM CLOUD, this breach represents a potential supply chain risk. Attackers who gain API access can pivot lateraly through connected systems, escalate privileges, and cause damage far beyond what the initial credential count suggests. The 38,000-plus records in this dump represent real access points into active cloud enviroments.

How Stealer Logs Target Cloud Platforms

Stealer malware collects saved browser credentials, session cookies, and autofill data from infected devices. When cloud platforms store login tokens or API keys in browsers or local config files, stealers can grab those too. The resulting log files are organized by service type, making it easy for buyers to filter for cloud-specific access. This log was labeled with the HESOYAM CLOUD name, suggesting whoever packaged it already sorted the data by cloud service. This is a growing tactic used by access brokers who specialize in selling cloud infrastructure entry points to ransomware groups and other threat actors.

Check If You Are Affected

HEROIC runs the world's largest breach intelligence database, covering more than 400 billion exposed records. If your email address was part of the HESOYAM CLOUD stealer log or any other breach, HEROIC's free scanner will find it. Cloud account holders especially should run a check now. Knowing you are exposed is the first step toward locking down access before an attacker gets there first.