The ARCEUSULP 165: 365,521 Passwords Exposed. Yours Might Be One.

HEROIC analysts identified this stealer log on 20-Jun-2026. The breach exposed 365,521 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as ARCEUSULP 165.

Why This Is Dangerous

With 365,521 plaintext passwords now exposed, this breach hands attackers a massive collection of ready-to-use credentials. Because no decryption is required, every email and password pair in this dataset can be immediately tested against accounts across the internet. The URLs also reveal which services each victim used, making it straightforward for criminals to identify high-value targets such as banking or email accounts and attempt to log in directly.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

Leaks of this scale are used in large-scale credential stuffing campaigns that run around the clock. With over 365,000 stolen pairs, criminals can test these logins across banking sites, email providers, e-commerce platforms, and streaming services simultaneously. People who reuse passwords are especially vulnerable, as a single stolen credential can unlock multiple accounts at once, leading to financial fraud, identity theft, and personal data exposure.

How a Stealer Log Works

A stealer log is the product of malware that installs itself on a victim's computer through a phishing email, infected download, or malicious advertisement. Once running, the malware silently collects saved passwords, login URLs, and browser session data. This information is compiled into a log file and uploaded to private Telegram groups and dark web markets, where it is traded and used to compromise real accounts.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records from known breaches. Search your email address now to find out if your credentials appear in this breach or others. The scan is free and takes seconds.