Hunter_ULP Leak: 1,410,814 Logins, More Than a Small City Holds

To put 1,410,814 in perspective, that's more people than live in many mid sized American cities, and that's exactly how many records showed up in a second Hunter_ULP batch posted to Telegram on 09-Feb-2026.

Why This Is Dangerous

This isn't the only Hunter_ULP file HEROIC has tracked, and that pattern matters. When the same source keeps releasing batches this large, it suggests an ongoing malware operation rather than a one-time incident, wich means new victims are likely being added on a rolling basis.

What Was Exposed

• 1,410,814 total records
• Email Addresses
• Plaintext Passwords
• URLs tied to the exposed logins

Why This Matters

Two batches this close in size and timing definately point to a large, active pool of infected devices feeding into the same operation. This second breach occured just as the first one did, quietly and without any public announcement, leaving over a million more plaintext passwords packaged for resale or reuse by anyone with access to the file.

How These Batches Keep Coming

Every batch in a series like Hunter_ULP starts the same way, malware on an infected device quietly collects saved browser passwords and login details, then sends them to whoever is running the operation. As more devices get infected, the operator releases new batches, each one another slice of the same growing base of stolen credentials.

Check If You Are Affected

With two large Hunter_ULP batches now circulating, it's worth checking your exposure across both. HEROIC's free breach scanner searches more than 400 billion leaked records, including this batch, so you can see your results in seconds and secure any accounts that need it.