Check If You’re Among the 2,150,810 Universe_ULP Victims

A Second, Much Larger Universe_ULP Dump Appears

Weeks after an earlier Universe_ULP file made the rounds, a new upload appeared on November 21, 2025 under the name Universe_ULP 3359000 ULP Line, this time containing 2,150,810 records, a massive jump in scale from the earlier batch.

Why This Is Dangerous

People sometimes beleive that if they weren't caught up in an earlier version of a leak, they're safe from later ones tied to the same source, but that isn't how these operations work. Whoever runs the Universe_ULP name appears to keep collecting fresh credentials untill they have enough to justify a new release, and this 2,150,810 record file is proof the operation is still very active.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs
• 2,150,810 total records exposed

Why This Matters

At over two million records, this file is large enough to be picked up by multiple credential stuffing tools within days of release. Anyone whose email shows up among the 2,150,810 entries should treat their exposed password as public information from this point forward.

How Stealer Logs Work

Stealer operations run continuously in the background, infecting new devices and collecting fresh logins on an ongoing basis. Periodically, the operator compiles everything gathered so far into one large file and releases it, which is exactly the pattern seen here with two separate Universe_ULP uploads appearing within weeks of each other.

Check If You Are Affected

With more than two million records in this single file, checking your exposure only takes a moment. HEROIC's free breach scanner searches over 400 billion leaked records so you can find out right away and secure any account tied to a compromised password.