Slurm Logs Breach: 8,171 HPC Credentials Leaked

HEROIC's DarkHive intelligence system discovered the Slurm Logs stealer log breach, exposing 8,171 records. The incident occured in March 2025, when a Telegram user uploaded stolen credential data on March 23, 2025. The exposed records included email addresses, plaintext passwords, and URLs tied to Slurm workload manager systems and internal API host endpoints.

Why This Is Dangerous

Plaintext passwords in a Slurm environment represent an especially serious threat because cluster administrators often hold broad access across multiple systems. Attackers who obtain these credentials can log into Slurm management interfaces immediately and access all computational resources, job queues, and research data the account controls. The internal API host URLs provide additional direct access paths that bypass normal web-facing authentication entirely.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

Credential stuffing attacks test stolen email and password pairs across banking, email, cloud storage, and corporate networks simultaneously. Users who recieve the same password across multiple services face account compromise across all of them at once. For organizations using Slurm to manage HPC workloads, thier proprietary research, computational jobs, and internal infrastructure may now be accessible to criminals who downloaded this log from Telegram. Unauthorized access to cluster resources is often used for cryptomining or selling compute time to other attackers.

How Stealer Log Works

Stealer log malware typically targets system administrators and developers through convincing spear-phishing emails or trojanized software packages commonly used in technical fields. Once running on the victim's machine, it harvests all browser-stored passwords, SSH keys, and active session tokens. The malware transmits the collected data to attacker servers as a compact log file. The logs are then posted on Telegram channels where multiple criminal actors freely download them and use the credentials to launch seperate campaigns against the victims and any systems those credentials can access.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like Slurm Logs uploaded by Slurm Logs Free logs. Visit heroic.com to scan your email address and find out if your information was exposed.