30,541 Accounts Exposed as SunCloudNew Part09 Leaks Spread

A fourth SunCloudNew file, part09, joined the growing series on Telegram June 9, 2026, adding 30,541 more stolen logins to what is quickly becoming a massive combined leak.

Why This Is Dangerous

At this point, parts 06 through 09 alone account for well over 100,000 combined stolen records, all sharing the same plaintext password exposure and the same lack of any protection.

What Was Exposed

• Email addresses (30,541 unique accounts)
• Plaintext passwords with no encryption
• URLs tied to each compromised service

Why This Matters

If you haven't checked your email against any of the earlier SunCloudNew parts, checking just one file isn't enough, your credentials could show up in any of the numbered releases from this same campaign, and you may never recieve a warning that it happened.

How Stealer Logs Work

This ongoing part-by-part release pattern suggests the malware operator is still actively collecting new victims and releasing data in regular waves rather than a single dump. Each part likely represents a fresh batch pulled from recently infected devices, occassionally overlapping with earlier parts.

Check If You Are Affected

HEROIC's database now holds over 400 billion (400B+) leaked records, covering every part of the SunCloudNew series released so far. Run a free scan with HEROIC today and change any passwords that turn up, it's worth the two minutes it takes.