4.6 Million Records Exposed: Inside the ARCEUSULP 119 Leak

Over 4.6 million records were exposed when HEROIC analysts identified a stealer log named "ARCEUSULP 119" uploaded to a Telegram channel in July 2026. The file contained 4,644,616 records, each pairing a login URL, an email address, and a plaintext password harvested from infected devices.

Inside a Log This Size

A file of 4.6 million credential pairs is not the product of a single infection. Logs this large are typically compiled from many separate malware campaigns, then merged and labeled as one release, in this case under the name "ARCEUSULP 119." The scale alone makes this one of the larger stealer logs HEROIC has tracked recently.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• Associated Login URLs

Why This Matters

With millions of ready-to-use email and password pairs in one file, this log is a prime resource for large scale, automated credential stuffing against banks, retailers, and other online services. Anyone whose credentials appear here and were reused elsewhere faces a meaningful risk of account takeover, identity theft, and financial fraud.

How Stealer Logs Work

Stealer logs come from malware that infects a device, copies saved browser passwords and autofill data, and transmits everything to the attacker automatically. Large releases like ARCEUSULP 119 are often the result of combining output from a malware distribution operation running for weeks or months before the full log is packaged and shared.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including large stealer logs like this one. Run a free scan now to see if your credentials are among the 4.6 million exposed in ARCEUSULP 119.