ARCEUSULP 93 Data Breach: 228,319 Credentials Leaked Online

ARCEUSULP 93 Data Breach: 228,319 Credentials Leaked Online

On July 2, 2026, HEROIC analysts identified another stealer log in the ARCEUSULP series, labeled "ARCEUSULP 93 244967," uploaded to a Telegram channel the same day as a related release. This file contained 228,319 records, each pairing an email address with a plaintext password and the URL the login was used on.

Why This Is Dangerous

Released the same day as another entry in the same series, this file suggests an active, ongoing credential harvesting operation rather than a single isolated leak. With 228,319 plaintext passwords available for immediate use, attackers do not need to crack anything before starting large-scale login attempts across many websites.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters

At over 228,000 records, this leak provides more than enough volume for automated credential stuffing campaigns targeting banks, email providers, and retailers. Because it belongs to an active series releasing multiple large batches close together, people affected by this leak face an elevated risk of their credentials being reused, tested, and exploited by different actors over time, leading to account takeover and financial fraud.

How Stealer Logs Work

This release, the 93rd numbered batch from the ARCEUSULP source, was built the same way as its companion releases: infostealer malware silently harvests saved browser logins from infected devices, and the operator behind ARCEUSULP periodically compiles and releases the results, in this case 228,319 records, through Telegram channels used to distribute stolen credentials.

Check If You Are Affected

Given how frequently this source appears to release new batches, checking your exposure regularly is a smart habit. HEROIC's free breach scanner searches more than 400 billion leaked records, including active stealer log series like ARCEUSULP, to show you if your email address has been compromised. Run a free scan today and change any password that comes back as exposed.