If You Reuse Passwords, the Xavier_Ulp Leak Should Worry You

On 04-Aug-2026, HEROIC analysts identified a combolist named Xavier_Ulp - 399700 Xavier_Group shared on Telegram. The file contains 203,505 email and plaintext password pairs, each listed with the URL of the account it unlocks.

Why This Is Dangerous

With over 200,000 working email and password combinations in one file, an attacker has enough volume to run large-scale credential stuffing attacks, automatically testing every pair against popular websites to see which ones still work. The "ULP" in the file name is short for "user, login, password," the standard format criminals use to organize combolists like this one.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs for each affected login

Why This Matters

A combolist of this size, released by a group numbering its batches into the hundreds of thousands like "Xavier_Group," points to an ongoing, industrial-scale credential harvesting operation. If your email and password appear among these 203,505 records, and you reuse that password anywhere else, every one of those accounts is at risk of takeover.

How Combolists Work

A combolist is built by combining email and password pairs from older breaches and stealer logs into a single "ULP" formatted file, then testing each pair with automated checker tools to confirm it still works. Groups like Xavier_Group release these lists under a running count, in this case reaching 399,700 records processed to date, and sell or trade the validated portions on Telegram.

Check If You Are Affected

With over 200,000 credentials in this single dump, the odds of exposure are real. HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including this combolist, so you can confirm your exposure and change your password immediately.