How the Redline Cloud Dump Led to 1.9 Million Stolen Logins

HEROIC analysts identified a combolist called Redline Cloud ulpss 1 uploaded to Telegram in July 2026, containing 1,958,296 email addresses, plaintext passwords, and associated URLs. The file's name references the ULP format, short for 'URL, login, password,' a common way stealer-derived credentials get repackaged for resale. Why This Is Dangerous: A file this size gives attackers an enormous list of ready-to-use logins to test against banking sites, email providers, and shopping platforms all at once. Because the passwords are stored in plaintext, no cracking is required before criminals start using them. What Was Exposed: - Email addresses - Plaintext passwords - URLs linking each credential to the site it was used on Why This Matters: Combolists of this scale are typically built by combining smaller batches of stolen data, often sourced from malware infections, into one large file. If any of your accounts share a password with another site, a leak this size dramatically increases the odds that your credentials are somewhere inside it, exposing you to credential stuffing, account takeover, and downstream fraud. How It Happened: ULP-style combolists like this one are usually assembled from credentials harvested by information-stealing malware, such as the RedLine stealer family referenced in this file's name, then merged with data pulled from older breaches and phishing campaigns. Criminals stitch these sources together into one file and circulate it through Telegram channels and dark web forums to reach as many buyers as possible. Check If You Are Affected: With nearly 2 million records in this single file, checking your exposure matters. Use HEROIC's free breach scanner to search your email against more than 400 billion leaked records and find out if you were caught up in this dump.