The Rich_cloud Log Leaked 27,273 Passwords in 2025. Still a Threat.

HEROIC analysts identified a stealer log file tied to a source called Rich_cloud that was uploaded to a public Telegram channel on June 10, 2025. The file contains 27,273 records taken from infected devices, including email addresses, plaintext passwords, and the URLs of the accounts and services those passwords open. Even though this leak first surfaced more than a year ago, the credentials inside remain just as dangerous today for anyone who has not changed a reused password since.

Why the Rich_cloud Stealer Log Is Still Dangerous

Every password in this log is stored in plaintext, so there is no encryption standing between an attacker and the account it protects. Paired with the matching URL for each entry, the log tells an attacker exactly which site or service a stolen login opens. Passwords do not expire on their own, so a credential exposed in 2025 can still open an account today if it was never changed.

What Was Exposed in the Rich_cloud Log

• Email addresses
• Plaintext passwords
• URLs identifying the exact site or service tied to each login

Why 27,273 Exposed Accounts Still Matter

A working email and password pair does not lose its value with time the way other stolen data might. Attackers continue to run older logs like this one through automated credential stuffing tools, testing each login against banking sites, email providers, and shopping platforms. Anyone whose credentials are in this log and who reused that password elsewhere still faces a real risk of account takeover, identity theft, and financial fraud.

How a Stealer Log Like Rich_cloud Gets Created

Stealer logs are not the result of a company being hacked. They come from malware quietly installed on a person's device, often through a fake download or malicious attachment, that scans the browser for saved logins and copies the email, password, and web address for each one it finds. That data is sent back to whoever controls the malware, who packages it into a log file like this one and distributes or sells it through channels such as Telegram, sometimes long after the original infection.

Check If Your Email Is Still Exposed in the Rich_cloud Leak

If you want to know whether your email address is part of this leak or any other, HEROIC's free breach scanner checks it against a database of more than 400 billion leaked records. Run a free scan now and change any passwords you have reused across multiple accounts, even if the leak happened a while ago.