US Wrtcloud Users Exposed: 832K Emails and Passwords Leaked

On June 18, 2026, a stealer log labeled "ULP free wrtcloud" surfaced on Telegram, containing 832,480 records of email addresses, plaintext passwords, and login URLs tied to accounts flagged as United States-based. The data was harvested from devices infected with information-stealing malware and released for free, meaning it is already circulating well beyond a single buyer.

Who Ended Up in This Leak

The records in this file are tied to United States-based logins, pulled from whichever wrtcloud-connected accounts happened to be open on infected machines. Stealer logs do not target a single company or industry the way a corporate breach does. Instead, they scoop up whatever credentials are saved in an infected browser, which means anyone in the US who logged into a wrtcloud account from a compromised device could be part of this 832,480-record file, regardless of what they use the service for.

What Was Exposed

• Email addresses linked to US-based accounts
• Plaintext passwords stored without encryption
• URLs for the specific login pages each credential unlocks

Why This Matters

Because this log was released for free rather than sold privately, far more people can access it than a typical paid dump. That widens the pool of criminals running credential stuffing attacks against the emails and passwords inside it. Anyone who reused a leaked password on another account faces a real risk of account takeover, and once one account falls, identity theft and financial fraud often follow, especially when the compromised login doubles as a recovery email for other services.

How Free Stealer Logs Like This One Spread

Info-stealer malware infects a device, quietly copies saved browser credentials, and sends them to whoever is running the malware campaign. Rather than selling the results, some operators release the file for free on Telegram to build a reputation or attract buyers for future, more exclusive leaks. That is what "free" signals in this dump's name. It does not make the data any less real. It just means more people have already downloaded it.

Check If You Are Affected

If you are in the United States and have ever logged into a wrtcloud-connected account from a device that might have been infected, it is worth checking your exposure directly. HEROIC's free breach scanner compares your email against more than 400 billion leaked records, including free and paid stealer logs like this one, so you know exactly what is out there and what to change first.