SunCloudNew Data Breach: 109,146 Cloud Logins Now Exposed

SunCloudNew 1337 - 435K ULP joined the growing pile of cloud-themed stealer logs on November 19, 2025, bringing 109,146 more stolen login records into circulation on Telegram. This marks the second SunCloudNew-branded file to surface in recent weeks, and the naming pattern suggests the same operation behind the earlier release.

Why This Is Dangerous

Cloud storage accounts often hold more sensitive material than a typical email inbox, think backed up photos, financial spreadsheets, and scanned documents people assumed were safely tucked away. When a stealer log targets these kinds of services, the attacker isn't just gaining access to a username, they may be gaining access to years of personal files in one shot.

What Was Exposed

• Email addresses connected to cloud storage accounts
• Passwords recorded in plaintext with no protection
• URLs pointing directly to the cloud login pages affected

Why This Matters

Repeated releases under the same naming convention hint at an ongoing operation rather than a one-time incident. That is imporant to understand because it means new SunCloudNew files could keep appearing, each one adding fresh victims on top of the last. Anyone whose credentials were caught in the earlier SunCloudNew release should not asume this second file leaves them unaffected, since infections often continue collecting data over time.

Why Cloud Login Pages Keep Showing Up in These Logs

Stealer malware doesn't discriminate between a bank login and a cloud storage login, it grabs whatever the browser has saved. Because so many people leave their cloud accounts logged in permanently for convenience, those sessions and stored passwords are especially easy targets for malware quietly running in the background. Once collected, the credentials get bundled by platform, which explains why files like this one are labeled by brand name instead of randomly.

Check If You Are Affected

If you use any cloud storage service, take a minute to check whether your details showed up here. HEROIC's free scanner compares your email against more than 400 billion leaked records, covering both SunCloudNew releases and every other breach on file, so you get a complete picture of your exposure.