Slurm Logs Data Breach: 8,284 Stolen HPC Credentials

HEROIC's DarkHive intelligence system flagged the Slurm Logs stealer log breach, which exposed 8,284 records. The data was leaked on March 21, 2025, when a Telegram user uploaded a file containing stolen credentials tied to Slurm workload manager environments. The exposed records included email addresses, plaintext passwords, and system URLs associated with HPC cluster endpoints and internal API hosts.

Why This Is Dangerous

Plaintext passwords stolen from Slurm environments are immediately usable by attackers without any cracking step. Cluster administrators typically have access to dozens of connected compute nodes, storage arrays, and research databases. A single compromised Slurm account can allow criminals to harvest ongoing research, exfiltrate intellectual property, or weaponize the computing power for unauthorized jobs. The leaked URLs also reveal internal network topology that attackers use to pivot deeper into organizational infrastructure.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

When plaintext passwords are stolen, every account where that password was reused becomes vulnerable simultaneously. Credential stuffing tools automate the process of testing thousands of stolen pairs against banking portals, email providers, and cloud platforms within hours of a leak appearing on Telegram. For HPC users, thier research data and computational resources are at immediate risk. Organizations running Slurm for scientific computing or commercial modeling should assume any user appearing in this breach has had thier credentials fully compromised and force immediate password resets.

How Stealer Log Works

Stealer log malware spreads through trojanized utilities, cracked software, and spear-phishing attachments disguised as legitimate tools used in technical fields. After installation, the malware silently extracts credentials saved in browsers, SSH clients, and configuration files. It packages everything into a structured log and transmits it to attacker-controlled infrastructure. These logs are then sold or freely shared on Telegram channels, where criminal groups download them to conduct seperate waves of account takeover attacks against each victim.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from stealer log breaches like this Slurm Logs leak from March 2025. Visit heroic.com to scan your email address and find out if your credentials were exposed.