1,771,328 Plaintext Passwords Leaked: SunCloudNew Strikes Again

1,771,328. That's the record count inside "SunCloudNew 1030 - 3.40M ULP," a file that landed on Telegram on November 29, 2025 and instantly became the largest SunCloudNew release so far, nearly six times bigger than the previous batch from just ten days earlier.

Why This Is Dangerous

Numbers this large are hard to picture, but think of it this way: 1,771,328 is roughly the population of a mid sized city, and every single one of those records includes a working email address paired with a plaintext password. At this scale, even a tiny fraction of successful account takeovers still adds up to thousands of real victims.

What Was Exposed

• Email addresses tied to nearly 1.8 million individual logins
• Passwords stored as plain, unprotected text
• URLs identifying exactly which cloud services each login unlocks

Why This Matters

A jump from roughly 109,000 records in the last SunCloudNew file to over 1.7 million suggests the operation collecting this data has scaled up significantly, wether through more infections, a longer collection window, or both. Whatever the cause, the trend line is pointing in the wrong direction, and each new release definately puts more people at risk than the one before it.

How a Stealer Log Grows Into the Millions

Reaching a record count like this typically requires malware spreading across a large number of devices over an extended period, with the operator periodically exporting and merging the results into a single growing file. Rather than releasing small batches constantly, some operators wait and stockpile data until they have a headline making number to attach to the upload, which may explain why this file dwarfs the earlier SunCloudNew release.

Check If You Are Affected

With a file this large, checking your exposure isn't optional, it's basic digital hygiene. HEROIC's free scanner searches more than 400 billion leaked records, including this 1.77 million record SunCloudNew dump, so you can find out in seconds whether your credentials are part of the count.