The ’20M Fresh Private ULP’ Dump Put 13 Million Logins Online

In June 2026, HEROIC analysts identified a massive combolist titled '20M FRESH PRIVATE ULP 06-14' uploaded by a Telegram user. The file contained 12,955,787 records pairing email addresses with plaintext passwords, along with the URLs each login was tied to, with the bulk of affected accounts traced to the United States.

Why the 20M Fresh Private ULP Dump Is Dangerous

ULP stands for 'URL, login, password,' and that is exactly what this file delivers: nearly 13 million ready-to-use credential sets with the exact website each one belongs to. Because the passwords are stored in plaintext and labeled as 'fresh,' attackers can assume many of these logins are still active, making this one of the more immediately usable leaks HEROIC has tracked.

What the 20M ULP Leak Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters

At nearly 13 million records, this dump is large enough to fuel widespread credential stuffing campaigns, where attackers use automated tools to test each email and password pair across banking, email, and shopping sites. Because so many people reuse passwords, a single leaked credential set can lead to account takeover, identity theft, and direct financial fraud for millions of people at once.

How a 'Fresh Private ULP' Dump Like This Is Built

A ULP file is a specific style of combolist that pairs a URL with a matching login and password, usually compiled from a mix of malware infections, phishing campaigns, and older breach data, then labeled 'private' and 'fresh' to signal to buyers that the credentials have not been widely circulated or burned yet. These files are commonly sold or traded in bulk on Telegram channels and dark web marketplaces before smaller pieces filter out into public leaks.

Check If You Are Affected

With nearly 13 million records in this dump, the odds that your email address is included are real. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can quickly find out if your credentials were part of this leak and need to be changed.