U.S. Users Targeted: Cloud T106 Exposes 820,321 Passwords

HEROIC identified a massive stealer log dataset known as Cloud T106 circulating on Telegram in July 2026. The collection contains an alarming 820,321 compromised records extracted by infostealer malware, with a significant concentration of U.S.-based victims. All passwords are stored in plaintext, making this one of the most immediately exploitable credential dumps of its kind.

Over 820,000 Passwords Sitting in Plaintext

The sheer scale of this exposure is staggering. Every single password in the Cloud T106 dump is stored without encryption or hashing — in the exact form victims originally typed. At over 820,000 records, this provides attackers with an enormous pool of ready-to-use credentials, each one capable of granting instant access to a victim's account.

What Was Exposed

• Email Addresses — connecting hundreds of thousands of victims to their online accounts
• Plaintext Passwords — providing immediate, barrier-free access to compromised services
• URLs — mapping the full range of websites and services from which credentials were harvested

Credential Stuffing at Massive Scale

A dataset of this magnitude is a windfall for credential stuffing operations. Attackers feed hundreds of thousands of email-password pairs into automated bots that systematically test them against financial institutions, email platforms, corporate systems, and e-commerce sites. Given the pervasive habit of password reuse, even a low success rate across 820,321 records would yield tens of thousands of additional compromised accounts.

How Infostealers Harvested This Data

Every record in this dump represents a device infected by infostealer malware. These malicious programs spread through phishing links, trojanized software, and malvertising campaigns. Once active, they systematically extract saved passwords from every browser on the device, capture active session cookies, and record autofill information. The harvested data is then aggregated into massive log collections like Cloud T106 and distributed through Telegram's underground ecosystem.

Check If Your Credentials Were Exposed

Given the scale of this breach, the likelihood of exposure is substantial. HEROIC's breach monitoring platform tracks over 400 billion compromised records from breaches and stealer logs worldwide. Search your email address or domain using HEROIC's breach scanner to check if your credentials appear in this or any other known data exposure, and take immediate action to change any affected passwords.