4,994,336 Records Exposed in Nullcyber Cloud ULP Stealer Leak

4,994,336. That is the exact number of records sitting inside a file called ULP_Private_7140572_270925_190404_Nullcyber_Cloud, uploaded by a Telegram user in October 2025. Almost five million logins, all captured from real devices belonging to real people.

Why This Is Dangerous

A leak of this size is not just a bigger version of a small one, it's a different category of problem entirely. With close to five million entries, this file alone could definately contain login credentials for entire households, workplaces, or friend groups without any of them knowing they share the same exposure. The sheer scale means automated attack tools can run through the whole list in a very short amount of time.

What Was Exposed

• 4,994,336 total records
• Email Addresses
• Plaintext Password
• URLs for each captured login

Why This Matters

ULP stands for "URL, Login, Password," and that's exactly the format criminals prefer becuase it removes all the guesswork. There is no need to figure out which website a password belongs to, it's already labeled and ready to use. At nearly five million records, even a small percentage of still-valid logins would represent tens of thousands of accounts attackers could break into today.

How Stealer Logs Work

Files this large are usually not the work of a single infected computer. Instead, they are compiled from thousands of separate infostealer infections, each one contributing a batch of stolen browser credentials, wich are then merged, cleaned up, and repackaged into one master file, in this case named after the Nullcyber Cloud source that assembled it.

Check If You Are Affected

With almost five million records involved, the odds that your information is somewhere in a leak like this are higher than you might think. HEROIC's free breach scanner checks against a database of over 400 billion exposed records so you can find out right away and change any passwords that need it.