Analysts Trace the 1M ULOGS MIX Dump to 928,279 Stolen Logins

In June 2026, HEROIC analysts identified a large combolist named 1M ULOGS MIX GEOJUNE-26 circulating on Telegram, containing 928,279 records of email addresses and plaintext passwords, along with the URLs tied to each account.

Why This Is Dangerous

With nearly a million records in a single file, this combolist gives attackers an enormous pool of working credentials to test against websites around the world. The "GEO" in its name suggests the logins were mixed from multiple countries or regions, and because passwords are stored in plaintext, there is no barrier stopping immediate, automated login attempts.

What Was Exposed in the 1M ULOGS MIX GEOJUNE-26 Leak

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

A combolist of this scale is exactly what powers large-scale credential stuffing campaigns, where attackers use automated tools to test hundreds of thousands of email and password pairs against banking, email, and shopping sites in a matter of hours. Because so many people reuse passwords, even a small percentage of successful logins out of 928,279 attempts can translate into thousands of compromised accounts and cases of financial fraud.

How a Combolist Like This Works

A "mix" combolist like this one is typically assembled by combining smaller batches of leaked or harvested credentials, in this case labeled "ulogs" for user logs, from multiple sources into one large file. Sellers often name these files by size and date, such as "1M" and "GEOJUNE-26," to advertise scale and freshness to potential buyers browsing Telegram channels.

Check If You Are Affected

Given the size of this leak, checking your exposure is a smart first step. HEROIC's free breach scanner compares your email address against a database of more than 400 billion leaked records to tell you immediately if your credentials have appeared in this or any other dump.