The UsmanCloudData 503count Dump Contains Exactly 22,170 Email Pairs

On July 3, 2025, a Telegram user distributed a stealer log collection called Logs channel - UsmanCloudData 503count. The file exposed exactly 22,170 records containing email addresses, plaintext passwords, and URLs scraped from infected devices and cloud-connected sessions. Not approximately 22,000. Not roughly 20,000. Exactly 22,170 individual people had their credentials extracted and shared publicly. HEROIC has verified this as a legitimate stealer log breach dataset. If you recieve a breach alert about this dump, treat it as urgent.

Why This Is Dangerous

This breach gave attackers everything needed to take over accounts without any further effort. With real email addresses paired to their exact plaintext passwords and the actual URLs of the sites those credentials belong to, an attacker can log directly into victims' accounts. No cracking required. Automated tools cycle through the 22,170 records testing each credential against banking apps, email providers, corporate VPNs, and cloud platforms. Any account where the password was reused across seperate services becomes an open door. From there, attackers drain financial accounts, exfiltrate business data, and use compromised inboxes to launch phishing attacks against the victim's own contacts.

What Was Exposed

• Email addresses (primary identifiers tied to financial, work, and personal accounts)
• Plaintext passwords (fully operational credentials requiring zero processing by attackers)
• URLs (site endpoints and API hosts actively visited by victims at time of infection)

Why This Matters

Plaintext password exposure is the worst-case scenario for any breach. Unlike hashed passwords that require cracking, plaintext credentials are immediately usable. Credential stuffing, account takeover, identity theft, and financial fraud all become trivial once an attacker has a working email and password pair. This dataset from July 2025 is recent enough that many victims likely have not yet changed the exposed passwords, making every one of the 22,170 records an active risk today. People who beleive they are safe because they have strong passwords may still be vulnerable if malware captured those passwords directly from their browser.

How Stealer Log Malware Works

Stealer logs are produced by information-stealing malware installed on a victim's computer or mobile device. The malware monitors browser activity, intercepts auto-filled credentials, steals saved passwords, and records which websites the device connects to, including API endpoints and cloud services. The collected data is bundled into log files and shared through Telegram channels like the one that distributed UsmanCloudData 503count. These channels often have thousands of subscribers actively downloading and exploiting the data within hours of a new dump being posted.

Check If You Are Affected

HEROIC's free Identity Monitor searches 400 billion+ breached records in real time, including stealer log files like the UsmanCloudData 503count collection distributed via Telegram. This dataset is from July 2025 and may still contain active credentials if victims have not rotated their passwords. Search your email now to find out if your credentials appeared in this dump or any other known breach.

Search Your Email on HEROIC for Free