Slurm Logs Breach: 5,316 HPC Credentials Leaked

HEROIC's DarkHive intelligence system discovered the Slurm Logs stealer log breach, exposing 5,316 records. The incident occured in April 2025, when a threat actor uploaded stolen log data to a Telegram channel. The exposed records included email addresses, plaintext passwords, and URLs tied to systems running the Slurm workload manager used in high-performance computing environments.

Why This Is Dangerous

Attackers who obtain these credentials can log into Slurm-managed HPC clusters and steal research data, intellectual property, or proprietary computational results. Plaintext passwords make account takeover instant: no cracking required. Exposed API hosts and internal URLs give attackers a roadmap to backend infrastructure, allowing them to pivot across connected systems, launch cryptomining operations, or exfiltrate data at scale.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

Credential stuffing attacks thrive on plaintext password dumps like this one. Attackers load the email and password pairs into automated tools and test them against dozens of popular services simultaneously. Victims often don't know thier accounts are compromised until fraudulent activity is already underway. For organizations using Slurm in research or enterprise settings, a single compromised account can cascade into full cluster access, data loss, and costly incident response.

How Stealer Log Works

A stealer log breach starts when malware, often delivered through phishing emails or malicious downloads, infects a user's device. The malware silently collects saved passwords, browser cookies, and session tokens, then packages everything into a log file. These files get uploaded to Telegram channels or dark web forums where other criminals purchase or freely download them. The entire process is publically automated, making it fast and cheap to execute at scale.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like Slurm Logs uploaded by NEW Pegasus Cloud. Visit heroic.com to scan your email address and find out if your information was exposed.