Quietly, AMRTECH ULP_FREE 61 AMRTECHVIP 2 Exposed 30.3M Credentials

HEROIC analysts quietly logged one of the larger files in this series: AMRTECH ULP_FREE 61 AMRTECHVIP 2, dated 14 Jan 2026, holding 30,373,303 login records of email addresses, plaintext passwords, and URLs. Scanning your email is the only way to know if you're in it.

30 Million Plaintext Passwords, Sitting in the Open

A file this large rarely gets attention the way a single high profile leak does, which is exactly what makes it dangerous. Thirty million readable passwords moving quietly through channels like Telegram can be tested at scale without anyone noticing until accounts start failing.

Plaintext storage means every one of those passwords is usable the moment it's extracted, with no cracking delay to slow anything down.

What AMRTECHVIP 2 Put Into Circulation

• Email Addresses: identifies real people for targeted phishing or matching against other leaked data.
• Plaintext Password: usable immediately anywhere it has been reused, with nothing left for an attacker to figure out.
• URLs: points directly to the service each password was tied to, narrowing the target instantly.

A File This Size Rarely Stays Quiet

Thirty million entries is large enough to support automated, large scale credential stuffing against sites well beyond wherever these pairs originated. The realistic consequences are account takeover, fraudulent orders placed under your name, or an inbox quietly used to reset passwords elsewhere.

The Quiet Mechanics of a Combolist

A combolist is assembled by pulling email and password pairs from many smaller sources and merging them into one large file built for reuse testing against other sites. Its size says more about how much was gathered than it does about any single service being broken into.

Is Your Email Among the 30,373,303 in AMRTECHVIP 2?

Run a scan your email to find out. If it turns up, change that password on every site where you've reused it, since a combolist of this size is built exactly for that kind of testing.

Treat a work inbox the same as a personal one here; size doesn't change which addresses are at risk.