Dark Web Intel: ARCEUSULP 250 Leak Dumps 569,859 Stolen Logins

Dark Web Intel: ARCEUSULP 250 Dump Surfaces With 569,859 Logins

On June 20, 2026, HEROIC analysts tracking dark web and Telegram chatter identified a stealer log labeled "ARCEUSULP 250 1518076," tied to a threat actor or group operating under the ARCEUSULP name. The file contained 569,859 records, each combining an email address, a plaintext password, and the URL the login was used on.

Why This Is Dangerous

Numbered releases like this one, part of a series bearing the same ARCEUSULP label, suggest an ongoing operation rather than a single one-off leak, meaning more batches from the same source may already be circulating or still to come. With nearly 570,000 plaintext credentials in this file alone, attackers have an immediately usable list for large-scale login attempts.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters

A leak of this size feeds directly into credential stuffing, where attackers use automated tools to try each stolen login across many other websites. Because ARCEUSULP appears to be releasing these logs in a numbered series, the same underlying infections may be feeding multiple leaks over time, increasing the odds that a person's credentials appear in more than one dataset and raising the long-term risk of account takeover and financial fraud.

How Stealer Logs Work

Dark web intelligence suggests operations like ARCEUSULP rely on infostealer malware to continuously harvest saved logins from infected devices, then periodically package and release the results as numbered batches, in this case reaching 569,859 records for this single release. Each new number in the series likely represents a fresh batch of infections or a repackaging of previously stolen data, distributed through Telegram and dark web channels.

Check If You Are Affected

Because operations like this one tend to release data in ongoing waves, checking your exposure regularly is worth doing. HEROIC's free breach scanner searches more than 400 billion leaked records, including ongoing stealer log series like ARCEUSULP, to show you if your email address has been compromised. Run a free scan now and change any exposed passwords immediately.