Slurm Logs Jun 27 2025: 27,741 U.S. Credentials in Earliest Confirmed Campaign Drop

HEROIC's DarkHive intelligence system discovered the Slurm Logs data breach dated June 27, 2025, exposing 27,741 records. This Telegram-distributed stealer log is the earliest confirmed release in the entire Slurm Logs campaign, establishing the operation was active by late June 2025. It contains email addresses, plaintext passwords, and login URLs captured by infostealer malware from U.S. user devices, beginning a campaign that ran through August 29, 2025.

Why This Is Dangerous

Stealer logs expose plaintext credentials captured live at the moment of login. Each of the 27,741 records contains a working password paired with the exact site where it was entered. Attackers recieving this data can begin credential stuffing attacks against banking, email, and social media accounts immediately, with no cracking required. Thier automated tools can validate thousands of accounts per hour against live platforms.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs

Why This Matters

As the earliest confirmed release in the Slurm Logs series, the June 27 dataset carries the widest exposure window of the entire campaign. Credentials from this drop have been in attacker hands since late June 2025, giving the longest possible time for testing, trading, and incorporation into aggregated credential databases. Credential stuffing, identity theft, and unauthorized account access are the primary risks. Password reuse across seperate platforms amplifies the damage from any single stolen pair, and individuals in this earliest release are most likely to have already experienced account compromises from credential stuffing attacks in the months since publication.

How Stealer Logs Work

Infostealer malware spreads through phishing emails, malicious software downloads, and compromised websites. Once silently installed, it records every login session: the email address, the plaintext password, and the target URL. This data is exfiltrated to operator servers and published in batches through Telegram channels like Slurm Logs. The June 27 release marks the opening of a campaign that would escalate through the summer before its final burst in late August 2025.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like Slurm Logs SlurmLogs uploaded by a Telegram User. Visit heroic.com to scan your email address and find out if your credentials were exposed in this June 27, 2025 stealer log release or any other drop in the series.