Patched_Cloud’s Telegram Drop: 9,637 Americans Just Had Their Passwords Published Online

HEROIC's DarkHive team identified a stealer log posted to Telegram on March 30, 2026 through the Patched TG channel. The file, labeled Patched_Cloud, contained 9,637 compromised records from users in the United States. Each record paired an email address and a plaintext password with the URL of the exact service where those credentials were harvested. No paywall. No access requirement. Available to any subscriber immediately after posting.

What It Means When a Stealer Log Contains Your Credentials

Being in a stealer log is different from being in a leaked database. A database leak means a company lost your data. A stealer log means malware ran on a device you used, captured your credentials at the source, and packaged them for distribution. The password in this file is not a recovered hash. It is the actual string of characters you typed. The attacker knows your exact password for the specific service you logged into, and they have the URL to go straight there.

That specificity is what makes stealer logs more immediately dangerous than most breach types. There is no guesswork involved and no cracking step required.

What Patched_Cloud Contains

• Email addresses linked to personal accounts and business services
• Plaintext passwords captured directly from infected devices
• URLs and API endpoints revealing which platforms were specifically targeted

The Realistic Risk Breakdown for Anyone in This File

With complete email-password-URL triplets in hand, attackers can pursue several attack paths depending on what the credentials unlock:

• Account takeover: Direct login to the specific service listed in the record
• Credential stuffing: Testing the same pair across banking, email, and social platforms
• Email account compromise: Using inbox access to trigger password resets on other services
• Business email compromise: Targeting corporate email accounts to impersonate employees or executives

Password reuse is the factor that determines how far the damage spreads. One compromised pair from this file can unlock accounts the victim never imagined were connected.

How the Patched_Cloud Log Was Built From Real Infected Machines

Infostealer malware is the tool behind stealer logs. It reaches devices through channels that are easy to miss: a phishing message styled like a routine notification, a software installer that came bundled with a free tool, a browser extension that seemed legitimate but was not. Once installed, it runs silently, scanning for saved passwords in every browser profile, extracting active session cookies, and capturing credentials stored by applications.

The collected data is automatically structured into a log file and transmitted to the channel operator. From there it is packaged and posted. The infected user sees nothing. Their device behaves normally. The first indication is typically a locked account or a bank alert weeks later, long after the data has already been traded and used.

Security Teams: This File May Contain Your Employees' Credentials

Stealer logs frequently include corporate email addresses harvested from employee personal devices or work machines that were compromised outside the office. If a single employee in this dataset reused their work password for a personal account that was captured by the malware, your organization's systems may already be at risk.

HEROIC's breach scanner searches your email against more than 400 billion exposed records, including the Patched_Cloud log. Security teams can use it to check employee email addresses and identify any credentials that need immediate rotation. Individual users can run the same check in seconds to see if their personal accounts are in the file.

Run your free scan now at HEROIC.com.