Slurm Logs Jun 28 2025: 27,730 U.S. Credentials Show Campaign Began Before July

HEROIC's DarkHive intelligence system discovered the Slurm Logs data breach dated June 28, 2025, exposing 27,730 records. This Telegram-distributed stealer log is one of the earliest confirmed releases in the entire Slurm Logs campaign, showing the operation was already active before July 2025. It contains email addresses, plaintext passwords, and login URLs captured by infostealer malware from U.S. user devices.

Why This Is Dangerous

Stealer logs expose plaintext credentials captured live at the point of login. Each of the 27,730 records contains a working password tied to the specific site where it was submitted. Attackers recieving this data can immediately begin credential stuffing attacks against banking, email, and social media accounts. Thier automated tools process thousands of login attempts per hour, identifying compromised accounts without any cracking or decryption required.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs

Why This Matters

As one of the earliest releases in the Slurm Logs series, the June 28 dataset has the longest exposure window in the entire campaign. Credentials captured on June 28 have been in attacker hands for the full duration of the operation and well beyond. Credential stuffing, identity theft, and financial fraud are the primary risks. Password reuse across seperate platforms extends the impact: a single captured credential pair can open multiple accounts on services the victim uses elsewhere, and early-series data is most likely to have been incorporated into aggregated credential databases used for immediatly ongoing account takeover operations.

How Stealer Logs Work

Infostealer malware spreads through phishing emails, fake software downloads, and compromised websites. Once silently installed on a victim device, it records every login: the email address, the plaintext password, and the target URL. This data is exfiltrated to operator servers and published in batches through Telegram channels like Slurm Logs. The June 28 release is evidence the operation was established by late June, weeks before the higher-volume July drops that drew wider attention.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like Slurm Logs SlurmLogs uploaded by a Telegram User. Visit heroic.com to scan your email address and find out if your credentials were exposed in this June 28, 2025 stealer log release or any other drop in the series.