US Users Exposed as IggyCloudV1 Leaks 6,709,744 Stolen Records

The infected devices behind IggyCloudV1 trace back mainly to the United States, and the numbers are hard to ignore. This fourth entry in the IggyCloudV1 series, uploaded to Telegram on March 29, 2026, contains 6,709,744 records, one of the larger stealer logs seen from this operation so far.

Why This Is Dangerous

When a leak this size concentrates on users in one country, it means a huge number of American accounts are sitting in a single file, ready for anyone to download. It is not neccessary for an attacker to sort through global data looking for US targets, IggyCloudV1 does that work for them, with 6,709,744 records already grouped together.

What Was Exposed

The fourth IggyCloudV1 file, dated March 29, 2026, includes:

• Email addresses, largely tied to United States users
• Plaintext passwords
• URLs showing which sites the credentials belong to

6,709,744 records makes this one of the largest single leaks in the IggyCloudV1 series discovered so far.

Why This Matters

A file concentrated on one country's users is imediately more valuable to criminals running localized scams, fake bank alerts, or tax season phishing, because the messages can be written to match what people in that region actually expect to see. With 6,709,744 accounts to work through, attackers have plenty of room to test which approaches work best before scaling up.

How Stealer Logs Work

IggyCloudV1 appears to be an ongoing operation, wich this fourth numbered release confirms, with malware infecting devices, harvesting saved browser credentials, and exporting them into version labeled log files. Each new release adds millions more records to what is already a substantial collection of stolen US credentials.

Check If You Are Affected

With millions of American accounts already exposed in this series alone, checking your own status takes just seconds. HEROIC's free breach scanner searches more than 400 billion leaked records worldwide, so you can see immediately if your email appears in IggyCloudV1 or any other stealer log.