PrivatArtHouse Cloud Leak Exposes 46,497 Passwords

Look closely at the file name and you'll spot the tell: bonus PrivatArtHouse CLoud.part02, one piece of a larger stealer log set uploaded to Telegram in February 2026. That single "part02" file alone held 46,497 records pairing email addresses with plaintext passwords and the exact URLs those logins unlock.

Why This Is Dangerous

At this scale, an attacker isn't targeting one person, they're running automated scripts across tens of thousands of accounts at once. Because every password is stored in plain text next to its matching site, there's no cracking or guessing involved. It's copy, paste, and log in.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

A file this large is a goldmine for credential stuffing. Attackers feed all 46,497 records into automated tools that test them against banking sites, email providers, and online stores. Every reused password becomes a potential account takeover, and from there, identity theft or financial fraud follows quickly.

How Stealer Logs Work

The word "bonus" and the "part02" labeling suggest this file was split and distrubuted alongside other batches, a common tactic sellers use to tease buyers into larger purchases. The underlying malware works the same way regardless of packaging: it infects a device, quietly pulls saved credentials from the browser, and ships them off to be compiled into logs like this one.

Check If You Are Affected

With tens of thousands of records in play, checking your exposure only takes a few seconds. HEROIC's free breach scanner searches more than 400 billion leaked records, including this stealer log, so you know exactly where you stand.