185,381 Records Leaked From Xavier Group’s Telegram ULP Dump

185,381. That's how many records just surfaced in a fresh ULP dump tied to Xavier Group, uploaded straight to Telegram by an anonymous user on 20-May-2026.

Why This Is Dangerous

ULP stands for "URL, login, password," and that's exactly the format this file follows, line after line of ready-to-use credentials. There's no cracking or guessing required, wich makes this kind of leak especially risky for everyone whose information got swept up in it.

What Was Exposed

• 185,381 total records
• Email Addresses
• Plaintext Password
• URLs

Why This Matters

A leak this size doesn't stay in one seperate corner of the internet for long. Once a file like this starts circulating, it gets copied, repackaged, and traded across dozens of forums, so even if the original post disappears, the data itself rarely does.

How ULP Dumps Work

Most ULP files start life as stealer log output that someone reformats into a cleaner, more useable structure: url, then email or username, then password, all separated by a colon. Criminals prefer this format because it plugs directly into automated login tools that test thousands of accounts a minute untill they find ones that still work.

Check If You Are Affected

You shouldn't have to guess whether your credentials are part of a dump like this one. HEROIC offers a free breach scanner that checks your email against more than 400 billion compromised records, giving you a clear answer and next steps in seconds.