WATERCLOUD_NOTIFY Leak Exposes 6,196 Plaintext Logins Now

HEROIC analysts identified a stealer log package known as WATERCLOUD_NOTIFY, a set of 482 individual files dated August 8, 2024, together holding 6,196 records that pair an email address with a plaintext password and the site it came from. Scanning your email is the only way to know if you are one of the 6,196 people affected.

Why This Is Dangerous

Every password in this collection sits as plain, readable text, so there is nothing standing between the file and someone trying it on a real login page. Spreading the data across 482 separate files does not reduce the danger, it simply means the same information is packaged in smaller pieces that are just as easy to search through.

• Email addresses
• Plaintext passwords
• URLs tied to each saved login

Attackers commonly combine files like these and run them against major email, banking, and shopping platforms in bulk. A single reused password can turn one exposed login into several compromised accounts, and access to an email inbox in particular can be used to reset passwords elsewhere.

A file collection like this comes from malware that ran on infected devices, quietly copying saved browser logins along with the exact web addresses they belonged to. No company had its systems broken into for this to happen; the exposure traces back to individually compromised machines.

Check Whether You Are Affected

Scan your email to see if it appears in this file or other known exposures. If it matches, change that password right away along with any other account where you used the same one, this applies whether the email is personal or tied to your work.