HEROIC Analysts Flag Telegram Leak of 16,106,380 Records

HEROIC analysts flagged a massive new upload this week: "UL G - WichLoveFromR," a ULP style dump posted to Telegram on 16-May-2026 containing 16,106,380 records. It is one of the largest single files the team has logged in recent months.

Why This Is Dangerous

A file of over sixteen million records is large enough to touch entire families, workplaces and friend groups all at once. Every record pairs an email address with a plaintext password and a URL, so analysts note that automated credential stuffing tools could process this entire file against major websites in a matter of hours.

What Was Exposed

• 16,106,380 individual records
• Email Addresses
• Plaintext Password
• URLs tied to each login

Why This Matters

ULP, wich stands for URL, login and password, is one of the most immediately usable formats criminals can get their hands on because it removes all the guesswork. Analysts point out that a leak this large will almost certainly get repackaged and resold many times over, so even if you never see the original file, your data can keep circulating long after the initial upload.

How Stealer Logs Work

Large ULP files like this one are typically assembled by combining smaller stealer logs from many different malware campaigns into a single searchable list. Analysts beleive this kind of aggregation is done specifically to make the data more attractive to buyers, since a sorted, formatted file sells for more than raw, messy logs.

Check If You Are Affected

Given the scale of this particular leak, HEROIC recommends checking your exposure right away using the free breach scanner, which searches more than 400 billion leaked records to tell you in seconds if your email appears in this or any other breach.