8,046 HPC Records Exposed in Slurm Logs Stealer Breach

HEROIC's DarkHive intelligence system identified the Slurm Logs stealer log breach on March 19, 2025, which exposed 8,046 records uploaded to a Telegram channel by a threat actor. The compromised data included email addresses, plaintext passwords, and URLs linked to Slurm high-performance computing environments, revealing direct access paths into cluster management systems and internal API endpoints.

Why This Is Dangerous

Slurm manages job scheduling across HPC clusters and its credentials frequently grant access to shared compute resources, research storage, and administrative interfaces. Attackers with valid Slurm credentials can submit unauthorized jobs that drain organizational compute budgets, access confidential research datasets, or pivot through the internal network to compromise additional systems. The leaked URLs provide roadmaps to internal services that are often not exposed to the public internet and therefore have weaker perimeter defenses.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

Plaintext passwords require no cracking and can be tested against dozens of services the moment they appear on Telegram. Credential stuffing attacks are automated and can attempt logins against banking portals, email systems, cloud platforms, and VPNs all at once. For research institutions and enterprises running HPC workloads, thier proprietary calculations, datasets, and client information stored on cluster nodes may now be exposed. Even users who do not directly manage Slurm infrastructure face risk if they reused thier cluster password on any other account.

How Stealer Log Works

Stealer log infections typically begin through phishing emails, malicious browser extensions, or trojanized versions of legitimate software. Once the malware runs on a victim machine, it scans all browsers, password managers, and application configuration files for stored credentials. The collected data is compressed into a log bundle and silently sent to attacker servers within minutes. Criminal groups then distribute these logs on Telegram, where other attackers download them and launch seperate credential stuffing and account takeover campaigns targeting each identified victim.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from stealer log breaches like this Slurm Logs leak. Visit heroic.com to scan your email address and find out if your information was included in this or any other breach.