Your Plaintext Password Is Next: Horizon Clouds 13M ULP on BreachForums
HEROIC analysts found that a credential dataset titled Horizon Clouds 13M ULP, posted by threat actor paninecon on BreachForums on July 2, 2024, exposed 894,124 unique records drawn from a broader collection of approximately 13 million lines. The compromised data includes email addresses, homepage URLs, and plaintext passwords. This release is one part of an ongoing series of Horizon Clouds releases by paninecon on BreachForums; related releases include BreachForums Horizon Clouds 41M ULP by paninecon and the Horizon Clouds 14M ULP analysis.
Why This Is Dangerous
Plaintext passwords require no cracking and can be deployed immediately in automated credential stuffing tools. The URL:login:password format of this dataset is a standard infostealer output structure that maps each password directly to the service it belongs to, giving attackers a precise, service-specific attack vector rather than a generic credential dump. The result is highly targeted account takeover operations with a far higher success rate than untargeted credential spraying.
What Was Exposed
- Email addresses
- Homepage URLs
- Plaintext passwords
Why This Matters
When plaintext passwords are matched to their corresponding service URLs, attackers can immediately attempt account takeovers on banking platforms, e-commerce sites, and email providers. Successful account takeovers enable financial fraud, unauthorized purchases, identity theft, and secondary access to linked accounts through password reset flows. The scale of this release, nearly 900,000 unique email addresses from a single forum post, ensures broad exposure across many different services and geographies.
How Database Breaches Work
The Horizon Clouds dataset follows the URL:login:pass structure typical of infostealer output compiled from thousands of infected endpoints. Infostealers harvest browser-saved credentials and transmit them to attacker-controlled infrastructure. The aggregated logs are then curated, deduplicated, and posted to forums like BreachForums where they are freely downloaded or sold. Each subsequent release in the Horizon Clouds series represents an additional tranche of victims from the same underlying collection.
Check If You Are Affected
HEROIC provides a free identity scanner that checks your email address against a database of over 400 billion compromised records, including the full Horizon Clouds series posted by paninecon on BreachForums. Visit heroic.com to scan your email address at no cost and find out immediately whether your credentials were included in this release or any related Horizon Clouds dataset.
Related Parts of This Breach
Breach Breakdown
894,124 passwords exposed. Is yours one of them?
Enter your email to scan this breach plus 400B+ other leaked records. If you're compromised, we'll show you exactly where and what to change.
Free forever · No account required · Results in seconds
/img/qr-code.png)