HEROIC Analysts Flag Xavier_Group ULP Leak Of 228,639 Records

HEROIC analysts flagged a new combolist on 15-Apr-2026 labeled Xavier_Ulp - 356200 Xavier_Group, and the numbers inside it are hard to ignore: 228,639 individual login records, all pulled together into one downloadable file and shared through Telegram.

Why This Is Dangerous

A file this large doesn't just embarass the people whose data landed in it, it puts them at real, immediate risk. Every record pairs an email with a plaintext password and the exact URL it works on, wich means an attacker can start testing logins the moment they download the file.

What Was Exposed

• Email Addresses
• Plaintext Password
• URLs
• 228,639 total records exposed

Why This Matters

At nearly a quarter million records, this leak crosses from "notable" into "significant" territory. Lists this size tend to circulate widely once they hit the dark web, getting copied into other collections long after the original Telegram post is gone.

How Stealer Logs Work

Behind every combolist like this one are dozens or hundreds of separate malware infections. Each infected device produces its own small stealer log, and someone with access to many of those logs combines them into a single searchable list. The bigger the number in the file name, the more individual logs likely went into building it.

Check If You Are Affected

With 228,639 records exposed, there's a real chance your information is in this file or one just like it. HEROIC's free breach scanner checks your email against a database of over 400 billion leaked records, so you can find out in seconds and take action right away.