34,589 Records Exposed in Echo Cloud Private ULP Stealer Leak

34,589. That's the exact record count found inside a stealer log dump called Echo Cloud - Private ULP, uploaded to a Telegram channel at the start of February 2026. Despite being labeled "private," the file didn't stay private for long once it started circulating.

Why This Is Dangerous

The word "private" in the file's name is almost ironic, since the entire point of these logs is that they get shared, sold, or traded the moment they're ready. Each of the 34,589 entries includes a plaintext password, meaning anyone who downloads the file can log straight into the associated account without needing to crack anything.

What Was Exposed

• Email addresses tied to individual accounts
• Plaintext passwords stored with no protection at all
• URLs identifying which websites the stolen logins belonged to
• 34,589 records total inside the Echo Cloud dump

Why This Matters

Calling a leak "private" doesn't change what happens to it once it's out. In fact, logs marketed this way sometimes command more attention because buyers assume the data hasn't been picked over by dozens of other criminals already, and that assumption alone can make a "private" leak spread even faster once word gets around. This one is a good example, and it's definately not something to brush off if your details are inside it.

How Stealer Logs Work

ULP, short for "URL, login, password," is the standard format infostealer malware uses when exporting stolen data. The malware infects a device, quietly reads through saved browser credentials, and lines everything up in that exact order before packaging it into a text file. Sellers then slap on labels like "private" to make their product sound more exclusive, even though it usually gets resold or leaked wider soon enough, wich is exactly what happened here.

Check If You Are Affected

Don't wait to find out the hard way. HEROIC's free breach scanner checks your email against a database of over 400 billion compromised records, including private stealer logs like this one, so you can see right away if your login information needs attention.