Researchers Find 95,265 Leaked Logins in ArtHouse Breach

Security researchers monitoring Telegram spotted a stealer log file, "premiumArtHouse Cloud Logs.part01," uploaded in January 2026 with 95,265 records inside. Anyone watching the channel could see the file appear, get downloaded repeatedly, and quietly spread across other groups within hours, each record carrying an email address, a plaintext password, and the site URL it was stolen from.

Why This Is Dangerous

What makes this file so easy to exploit is that nothing needs decoding. An observer can see exactly how attackers use it: open the file, copy a row, paste it into the matching login page, and the account belongs to them.

Multiply that by 95,265 rows and the scale of what just changed hands on a single Telegram channel becomes clear.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters

From the outside, this looks like just another file changing hands online, but the consequences are very real. Attackers use dumps like this for credential stuffing, running the same email and password against banking, shopping, and social media sites to see what still works.

Once a match is found, the path toward account takeover, identity theft, or financial fraud opens up fast, especially for anyone who reuses passwords across multiple accounts.

How Stealer Logs Work

Watching a stealer log take shape from the outside reveals a familiar pattern. Malware infects a device through a pirated app or fake download, quietly grabs saved browser passwords, and records every new login typed afterward.

The stolen data is compiled into a file and posted to Telegram, where it is downloaded, copied, and redistributed by anyone with access to the channel, spreading far beyond its original audience in a short amount of time.

Check If You Are Affected

Do not just watch from the sidelines. HEROIC's free breach scanner lets you check your own email against a database of more than 400 billion compromised records, including logs exactly like this one, so you can see for yourself whether you need to change a password today.