Researchers Link the DaisyCloud Dump to 240,596 Stolen Credentials

HEROIC researchers traced a large stealer log back to a public Telegram channel, where it was uploaded on June 16, 2025, under the name UP_DAISYCLOUD-CHAMPIONING. Analysis of the file confirmed 240,596 records from United States based accounts, each one pairing an email address with a plaintext password and the URL of the login page it came from.

Why This Is Dangerous

Researchers flagged this dump for its scale as much as its content. Because the passwords are stored in plaintext, there is no cracking involved, an attacker can load the file into automated tools and start attempting logins across hundreds of thousands of accounts almost immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters

At this scale, even a modest success rate produces a large number of compromised accounts. Attackers run dumps like this one through credential stuffing tools that quietly test each pair against banks, email providers, and online retailers. Any password reused elsewhere gives them an easy account takeover, and from there the path to identity theft and financial fraud is short.

How Stealer Logs Work

This is a stealer log, meaning the data was harvested directly from infected devices rather than pulled from a single company's server. Infostealer malware spreads through fake downloads, cracked software, and phishing attachments, then quietly collects saved browser passwords, autofill entries, and session cookies before sending them back to the operator. Large logs like this one are commonly labeled with a codename, such as DaisyCloud, and circulate on Telegram before being resold or folded into bigger combolists.

Check If You Are Affected

HEROIC researchers monitor exactly these kinds of dumps as they surface. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, so you can see quickly whether your credentials were part of this 240,596 record log or another one like it.