The InerealCloud 21M Dump Handed Hackers 5.2M Plaintext Passwords and URLs to Attack

HEROIC analysts detected a third installment of the InerealCloud credential series posted to BreachForums on March 20, 2025. This volume, labeled InerealCloud 21M ULP P3, contained approximately 21 million lines of raw data. After deduplication, analysts identified 5,195,681 unique records, each pairing an email address with a plaintext password and the URL of the site where that credential was used. This is the largest of the three InerealCloud parts released on the same day, and the combination of data types makes it immediately actionable for attackers.

The InerealCloud 21M Dump Gives Hackers Ready-to-Use Account Keys

With a plaintext password and the matching email address and website URL, an attacker does not need to do any additional work to attempt an account takeover. They can feed this data directly into automated tools that test credentials against dozens of platforms at once. If you use the same password across multiple accounts, those accounts are all exposed the moment this data is downloaded. The website URLs in the dataset function as a hit list, telling criminals exactly where to strike first and which services matter most to the affected users.

What Was Exposed in the InerealCloud 21M ULP P3 Stealer Log

• Email Address
• Plaintext Password
• HomePage URL

Why This Matters for People in the P3 Dataset

Stealer logs of this size fuel some of the largest credential stuffing campaigns recorded. When an attacker accesses your email account, the consequences ripple outward. Every other account that uses that email for password recovery is now vulnerable. Banks, investing apps, healthcare portals, and employer systems are all at risk through that one unlocked door. This kind of data also feeds identity theft operations where criminals open credit lines or file false tax returns using your name. With 5.2 million records in this single part alone, the probabilty of real-world harm from this dump is high.

How a Stealer Log Is Built and Distributed

Infostealer malware infects computers through phishing links, malicious downloads, or compromised software installers. Once running on a device, the malware copies saved passwords from web browsers, reads session tokens, and captures any autofill data it can find. This harvested material is sent back to the attacker automatically. The attacker then assembles millions of individual captures into a structured log file sorted by email, password, and URL. These logs are packaged and posted to forums like BreachForums, often in multiple parts as seen with the InerealCloud series, where they are downloaded and weaponized by criminal networks. The acount theft cycle begins the moment the file goes public.

Check If You Are in the InerealCloud 21M ULP P3 Leak

HEROIC's breach scanner indexes more than 400 billion compromised records, including this InerealCloud dataset. You can search your email address for free right now. If your credentials appeared in the P3 dump or any related InerealCloud release, HEROIC will tell you which breach is the source so you can take targeted action. Change your passwords and enable two-factor authentication on every platform where you use the same credentials.