The WATERCLOUD_NOTIFY Leak Quietly Exposed 16,065 Passwords

HEROIC analysts identified a stealer log file called WATERCLOUD_NOTIFY that quietly surfaced on a public Telegram channel on June 10, 2025. The file contains 16,065 records taken from infected devices, including email addresses, plaintext passwords, and the URLs of the accounts and services those passwords open. Unlike a headline-grabbing corporate breach, this leak arrived with no fanfare, just a file dropped into a Telegram channel for anyone to download.

Why the WATERCLOUD_NOTIFY Leak Is Dangerous

Every password in this log is stored in plaintext, with no encryption standing between an attacker and the account it protects. Paired with the URL for each entry, the log tells an attacker exactly which site or service a stolen login opens, so there is no guesswork involved in attempting to use it.

What Was Exposed in the WATERCLOUD_NOTIFY Log

• Email addresses
• Plaintext passwords
• URLs identifying the exact site or service tied to each login

Why 16,065 Quietly Leaked Passwords Still Matter

A leak does not need media coverage to cause harm. Attackers routinely feed logs like this one into automated credential stuffing tools that test each email and password combination against banking sites, email providers, and shopping platforms within minutes. Anyone who reused one of these passwords elsewhere faces a real risk of account takeover, along with the identity theft and financial fraud that often follow.

How a Stealer Log Like WATERCLOUD_NOTIFY Gets Made

Stealer logs are not the result of a company being hacked. They come from malware quietly installed on a person's device, often through a fake download or malicious attachment, that scans the browser for saved logins and copies the email, password, and web address for each one it finds. That data is sent back to whoever controls the malware, who packages it into a log file like this one and distributes it through channels such as Telegram, often with little notice until someone starts asking who is affected.

Check If Your Email Is in the WATERCLOUD_NOTIFY Leak

If you want to know whether your email address turned up in this leak or any other, HEROIC's free breach scanner checks it against a database of more than 400 billion leaked records. Run a free scan now and change any passwords you have reused across multiple accounts.