DRAGON_ULP 29 Leak: 2.5 Million Passwords Exposed. Yours Might Be One.

2,492,019 Records Exposed in the DRAGON_ULP 29 Combolist

HEROIC analysts identified a combolist titled "Private ULP by DRAGON_ULP 29" that a Telegram user uploaded on 12-Jul-2026. The file contains 2,492,019 records pairing email addresses with plaintext passwords, along with the URLs of the websites those credentials unlock.

Why This Is Dangerous

A combolist of nearly 2.5 million entries gives criminals a massive, ready-to-use list of working login pairs. Because each record lists a username, password, and destination URL together, attackers can point automated tools at this single file and attempt millions of logins without ever guessing a password.

What Was Exposed in the DRAGON_ULP 29 Combolist

• Email addresses
• Plaintext passwords
• URLs tied to each login pair

Why This Matters

Because the passwords in this combolist are stored in plain, readable text, anyone who downloads the file can use them the moment they open it. Files of this scale are commonly fed into credential stuffing tools that test each email and password pair against banking sites, email providers, and online retailers all at once. If any of the 2,492,019 people in this list reused a password elsewhere, that single exposed login can lead to a hijacked account, drained funds, or identity theft.

How Combolists Like This One Work

A combolist is a file that pairs stolen or previously leaked usernames and passwords into rows that other criminals can plug straight into automated login tools. Some entries come from older breaches, others from malware that harvested credentials directly off infected devices, and large files like DRAGON_ULP 29 are often stitched together from many smaller sources. Once assembled, lists like this circulate on Telegram channels and dark web forums, where anyone can download them and start testing logins within minutes.

Check If You Are Affected

If your email address might be among the 2,492,019 records in this combolist, HEROIC's free breach scanner checks it against a database of more than 400 billion leaked records, including combolists like this one. Run a free scan to see if your credentials were exposed, and update any password you have reused elsewhere.