Someone Has Your Password: 9,708 ArtHouse Cloud Credentials Leaked

HEROIC discovered a stealer log dataset called ArtHouse Cloud v2 USA circulating on Telegram in July 2026. This dump includes 9,708 compromised records harvested from U.S.-based users by infostealer malware. Every password in the collection is stored in plaintext, giving attackers a direct path into victims' accounts.

Why Plaintext Passwords Demand Immediate Action

When passwords leak in plaintext, there is no delay between exposure and exploitation. Attackers do not need to run cracking tools or invest computing resources. The stolen credentials are ready to use the moment they are downloaded. If your password appears in this dump, the window to protect yourself is already closing.

What Was Exposed

• Email Addresses — linking victims to their online identities and enabling targeted attacks
• Plaintext Passwords — granting instant, unrestricted access to compromised accounts
• URLs — revealing which specific services and websites were compromised

The Domino Effect of Credential Stuffing

Attackers rarely stop at one account. Using automated credential stuffing software, they take each email-password pair from this leak and test it against major platforms — from Gmail and Outlook to Amazon, PayPal, and banking portals. Because so many people reuse passwords, a single stolen credential often unlocks multiple accounts, creating a domino effect that can compromise an entire digital identity in minutes.

How Infostealer Malware Captured These Credentials

The records in this breach were extracted by stealer log malware — trojans that infect computers through phishing emails, pirated software, and compromised websites. Once installed, the malware silently harvests every password saved in your browser, along with cookies, autofill data, and cryptocurrency wallet information. The stolen data is bundled into logs and distributed through Telegram channels, where threat actors access it for free or at minimal cost.

Check If Your Credentials Were Exposed

Do not assume you are safe just because you do not recognize the source name. HEROIC's breach database contains over 400 billion compromised records collected from breaches and stealer logs worldwide. Search your email address or domain now to find out if your credentials appear in this or any other known data leak, and update your passwords without delay.