SlurmLogs Stealer Breach: 59,551 HPC Computing Records Exposed via Telegram

High-Performance Computing Credentials Exposed: The SlurmLogs Stealer Breach

Slurm -- the Simple Linux Utility for Resource Management -- is a widely deployed open-source workload manager used to schedule jobs on high-performance computting clusters at universities, national laboratories, and research institutions worldwide. In September 2025, a Telegram user uploaded a stealer log file exposing 59,551 records associated with Slurm enpoints -- including email addresses, plaintext passwords, and API host data. The presence of research computing credentails in stealer log circulation represents a qualitatively different risk than typical consumer credential breaches.

Slurm Logs SlurmLogs (September 2025): Breach Summary

• Records Exposed: 59,551
• Data Types: Email addresses, plaintext passwords, endpoint URLs, API host data
• Breach Type: Stealer log
• Password Type: Plaintext -- harvested directly from compromised devices, no cracking required
• Country: United States
• Date Leaked: September 18, 2025

Why Research Computing Credentials Are High-Value Targets

Access to Slurm-managed HPC clusters is typically gated by institutional credentials with broad access to computational resources. A compromised Slurm account may provide access to large-scale GPU or CPU compute time, research data stored on cluster file systems, network file system mounts containing proprietary research datasets, and job submission capabilities that could be abused for cryptocurrency mining, large-scale password cracking, or other computationally intensive attacker operations.

HPC cluster misuse is a documented threat vector. In 2020, multiple European HPC centers were compromised and used for cryptocurrency mining operations. Stealer logs targeting Slurm credentials represent a scalable approach to the same type of resource theft.

API Host Data: Beyond Basic Credential Risk

The inclusion of API host data in this stealer log elevates the risk beyond credential stuffing. API host information reveals the infrastructure topology of the compromised environments -- which services are exposed, what endpoints exist, and potentially how to authenticate to them directly. For research institutions, this could expose REST API endpoints for data repositories, computational services, or administrative interfaces that would not otherwise be visible to external attackers.

Unlike email/password combinations that can be rotated with a password change, API host data reveals architectural information that remains valid even after credentials are cycled.

Stealer Log Distribution: Telegram as a Credential Marketplace

This breach was distributed through Telegram -- a platform that has become a primary distribution channel for stealer log data. Telegram's combination of large group support, file sharing capability, and relatively permissive content moderation has made it the preferred venue for both free and paid credential distribution. Stealer log files uploaded to Telegram channels are typically indexed and searched by automated tools within hours of posting, dramatically compressing the window between upload and active exploitation.

For organizations running Slurm-managed HPC clusters, the appearance of cluster credentials in Telegram-distributed stealer logs is an immediate indicator of compromise requiring credential rotation and endpoint investigation.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to determine whether your email address appears in known data breaches, including the SlurmLogs stealer log. Run a free scan at HEROIC.com to identify any ongoing credential exposure.