Dark Web Intel: ARCEUSULP Combolist Exposes 72,572 Login Credentials

In June 2026, HEROIC's dark web intelligence team identified a large combolist labeled "ARCEUSULP 247 334479" circulating on Telegram, exposing 72,572 records that include email addresses, plaintext passwords, and the URLs tied to each account. Unlike the smaller Telegram uploads HEROIC tracks daily, a file of this size represents a substantial batch of ready-to-use credentials moving through criminal channels.

Why This Is Dangerous

Because the passwords in this file are stored in plaintext, an attacker does not need to crack or guess anything before attempting to log in. At more than 72,000 records, this combolist is large enough to power automated credential stuffing campaigns that test the same email and password pairs against dozens of websites in seconds, looking for any account where the password still works.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each account

Why This Matters

A leak of 72,572 accounts creates real, wide-reaching risk. If your email and password appear in this file, and you have reused that password anywhere else, an attacker can attempt account takeover on your banking, shopping, or social media accounts. At this scale, the fallout can extend into identity theft and financial fraud for a large number of people at once, not just the original account tied to the leak.

How This Combolist Was Assembled

Large combolists like ARCEUSULP 247 334479 are typically built by combining smaller batches of stolen credentials, gathered through phishing campaigns, malware infections, and older breaches, into one large file that criminals then trade or sell on dark web forums and Telegram channels. The scale of this file suggests it was compiled over time from multiple sources before being uploaded and shared.

Check If You Are Affected

With more than 72,000 accounts exposed, the odds that your information is included are higher than with smaller leaks. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to show whether your email and credentials appear in this leak or any other, so you can change your passwords before someone else uses them.