Abstract Corrosion attack in the form of corrosion product tubercles was observed in an AISI 304 (EN 1.4301) stainless steel heat exchanger only after 36 months of service. Failure analyses revealed that in one of the attacked areas corrosion had penetrated the entire wall thickness of 6.2 mm, but in most of the cases it reached the depth of 2–4 mm. In this paper, we report the results from a thorough microstructural characterization of the corroded heat exchanger carried out with optical microscopy (OM), scanning electron microscopy (SEM), energy dispersive spectroscopy (EDS), transmission electron microscopy (TEM) and X-ray diffractometry (XRD). Microstructural studies by OM, SEM and XRD revealed a two-phase structure of austenite and ferrite in the bulk material, as well as the preferential attack of the ferrite phase. SEM surface studies disclosed bacteria in and close to the attacked areas. Cross-sectional SEM examinations showed the distribution and composition of corrosion products within and underneath the tubercles. TEM and XRD studies gave information about the amorphous and/or nanocrystalline nature of some of the formed corrosion products. These results are discussed in this paper and, based on them, the main corrosion mechanism for the observed attack is suggested. Further, explanations for the propagation of corrosion along the ferrite phase are presented.