US Users Exposed in Bonus ULP UP_KURZL0G 10 Leak of 798,053 Logins

A stealer log named BONUS ULP UP_KURZL0G 10 surfaced on Telegram in October 2025, and HEROIC's dark web team traced the affected accounts back to the United States. Inside the file were 798,053 individual login records, each one a real account belonging to someone browsing the internet from a US based device at some point before the infection occured.

Why the Geography Matters

Knowing that a leak is concentrated among US users helps explain why it can spread so quickly through American targeted phishing campaigns and fraud rings. Criminals often build region specific attack kits, using leaked data from one country to craft more convincing scam emails or fake login pages tailored to services popular in that region. With 798,053 records tied to the US, this file is a ready made resource for exactly that kind of localized attack.

What Was Exposed

• 798,053 total records
• Email addresses
• Plaintext passwords
• URLs showing the sites tied to each login

Why This Matters

Even though this leak is not tied to one single company, its concentration in the United States means the accounts likely connect to services many Americans use daily, from email providers to shopping and banking sites. That overlap increases the chance that a leaked password here could still unlock something valuable somewhere else.

How Stealer Log Breaches Work

This type of file comes from infostealer malware that infects a device and pulls every saved password straight out of the browser without the user ever noticing. The stolen data gets bundled up and uploaded in bulk, wich is exactly how a regional collection like this one, all tied to the same country, ends up in a single Telegram post.

Check If You Are Affected

If you are located in the United States, leaks like this one are worth taking seriously. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including regional stealer log dumps like this, so you can find out fast and protect your accounts.