6,929 Slurm Logs Credentials Leaked in Stealer Log Breach

HEROIC's DarkHive intelligence system discovered the Slurm Logs stealer log breach, exposing 6,929 records. The incident occured in April 2025, when a threat actor uploaded stolen credential data to a Telegram channel on April 1, 2025. Exposed records included email addresses, plaintext passwords, and URLs linked to systems running the Slurm cluster management platform used in enterprise and research computing environments.

Why This Is Dangerous

Cluster management credentials are among the most dangerous data types that can be exposed: they grant access to entire computing environments rather than individual accounts. With plaintext passwords in hand, attackers can take over Slurm cluster accounts without any hacking effort. The exposed URLs give criminals a map of internal infrastructure, letting them directly access backend systems and move laterally across the entire computing environment.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

Credential stuffing tools automatically test stolen email and password pairs across dozens of services. Users who recieve the same password across systems face account takeover on every platform simultaneously. For enterprises running Slurm clusters, thier proprietary computational workloads, research datasets, and internal network access may all be compromised by attackers who exploit the exposed cluster credentials. Identity theft and unauthorized system access can persist for months before detection.

How Stealer Log Works

Stealer log malware typically enters corporate environments through targeted phishing emails directed at system administrators and developers. Once installed, it captures every password saved in the user's browser, along with SSH keys and session cookies. The malware then transmits the collected data to attacker servers as a structured log file. The files get posted on Telegram channels where criminal operators use them to conduct credential stuffing and account takeover campaigns across many seperate platforms simultaneously.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like Slurm Logs uploaded by Slurm Logs Free logs. Visit heroic.com to scan your email address and find out if your information was exposed.