100,560 Records Exposed in Xavier_Ulp 325400 Stealer Log Leak

100,560. That's the exact number of records packed into the Xavier_Ulp 325400 Xavier_Group stealer log, uploaded to a Telegram channel on May 2, 2026. Six figures worth of emails, passwords, and browsing URLs, all sitting in one downloadable file for anyone who wanted it.

Why This Is Dangerous

A number like 100,560 is big enough that automated tools, not individual criminals typing by hand, are what actually process a file this size. Scripts run through the list, testing each email and password pair against popular websites in seperate batches within minutes. There's no manual effort needed once the file changes hands.

What Was Exposed

• Email addresses tied to individual accounts
• Plaintext passwords with no encryption
• URLs identifying where each login was used
• 100,560 total records in the leak

Why This Matters

It's easy to think a leak this size only matters to security researchers, but each one of those 100,560 records represents somebody's actual email and password. Most victims have no idea anything happened until a strange login alert shows up or a purchase appears on a card they didn't touch.

How Stealer Logs Work

A stealer log like this one starts with malware quietly installed on a personal device, often through a pirated program or a fake browser extension, wich makes it easy to spread without anyone noticing right away. Once active, it scrapes saved passwords straight out of the browser and exports them into a single organized file. No corporate server was ever touched, the theft happened entirely on the victim's own machine.

Check If You Are Affected

You don't want to recieve bad news about your accounts after the fact. HEROIC's free breach scanner checks your email against more than 400 billion exposed records, this leak among them, so you can find out immediately and change any passwords that need it.