How The Primo Cloud Leak Exposed 16.9 Million Credentials

HEROIC analysts traced a massive stealer log labeled "TG-Primo_Cloud ULP Free 25_2T" back to a Telegram channel in February 2026. The file is one of the larger stealer logs HEROIC has reviewed this year, holding 16,967,829 records. Each entry pairs a stolen email address with its plaintext password and the exact URL where that login was captured.

Why The Primo Cloud Leak Is Dangerous

A file approaching 17 million records did not come from a single hacked company. It was built one infected device at a time, with malware quietly copying saved browser passwords from each victim before their data was bundled into this one giant collection.

Because every record already lists the matching website, the leak functions like a ready made key ring for millions of accounts at once, no extra research needed on the attacker's part.

What Was Exposed In The Primo Cloud File

• Email addresses
• Plaintext passwords
• URLs linked to each set of credentials

Why Nearly 17 Million Exposed Logins Matter

At this scale, criminals do not need to pick targets carefully. Automated tools run credential stuffing attacks across banking apps, email providers, and shopping sites, testing millions of stolen combinations in a short amount of time. Reused passwords are what turn one exposed login into several compromised accounts.

The consequences range from account takeover to identity theft and financial fraud, often striking people who never even knew there device had been infected in the first place.

How The Primo Cloud Leak Actually Happened

Logs of this size are built up over time. Infostealer malware spreads through pirated software, fake cracked applications, and malicious download links, silently harvesting saved logins from each infected browser.

Rather than releasing one small file, the group behind Primo Cloud appears to have merged results from a huge number of seperate infections into a single "free" release, likely to attract buyers before selling access to more exclusive, paid batches of stolen data.

Check If You Are Part Of The Primo Cloud Leak

HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including this Primo Cloud file, in seconds. Search now to find out if your credentials are among the nearly 17 million exposed and get clear steps to secure your accounts.