260,300 US Accounts Targeted in Xavier_Group ULP Data Leak

The file "Xavier_Ulp - 484700 Xavier_Group" surfaced on Telegram on 07-Feb-2026, and the people caught up in it are ordinary internet users based in the United States, the kind of accounts tied to email inboxes, shopping sites, and everyday logins. In total, 260,300 records made it into this dump.

Why This Is Dangerous

These aren't high profile executive accounts or government systems, they're regular people who happened to have malware quietly running on their computer. That makes the leak dangerous in a different way, most of the victims have no idea anything is wrong and probably won't find out untill something bad already happened to one of their accounts.

What Was Exposed

• 260,300 total records
• Email Addresses
• Plaintext Passwords
• URLs linking each record to its source account

Why This Matters

Everyday accounts are often the easiest targets because people don't expect to be a target at all. There's no dedicated security team watching a personal email account the way there is for a big company, so a leak like this one can go unnoticed for a long time, giving attackers a wide open window to work with.

How Stealer Log Breaches Work

This leak falls under the stealer log category, meaning it was built by malware installed on individual devices rather than stolen from a single company database. The malware collects saved logins straight from the browser and reports back everything it finds, wich is how ordinary people across the country ended up in a file being passed around on Telegram.

Check If You Are Affected

If you're a regular internet user in the US, this is exactly the kind of leak worth checking against. HEROIC's free breach scanner searches more than 400 billion exposed records and will tell you imediately if your email is part of this or any other leak on file.