SunCloudNew Data Breach: 26,480 Plaintext Passwords Leaked

SunCloudNew Stealer Log: 26,480 Credentials Exposed

HEROIC analysts found a stealer log file labeled "SunCloudNew 1277" uploaded to a public Telegram channel on September 5, 2025. The file contained 26,480 records taken directly from infected devices, pairing email addresses with plaintext passwords and the URLs of the accounts they open.

Why This Is Dangerous

Because these passwords were stored in plaintext, an attacker can use them immediately, with no cracking or guessing required. Each record already links a specific email, password, and website, giving criminals a ready-made list of working logins straight out of the file.

What Was Exposed

• 26,480 individual records
• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

Everyone in this log is exposed to immediate account takeover, and to credential stuffing anywhere else the same password was reused. A single working login can lead to email compromise, financial fraud, and identity theft as attackers branch out into connected accounts.

How Stealer Log Breaches Work

Stealer log malware infects a device through a fake download, cracked software, or a malicious attachment, then quietly copies saved browser passwords, autofill entries, and session cookies. The malware ships everything back to the attacker, who bundles the results, like this 26,480-record SunCloudNew file, and distributes them through Telegram channels and dark web marketplaces.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against more than 400 billion compromised records, including stealer log data like this SunCloudNew upload. Run a free scan to see if your credentials were exposed and what to do next.