The KURTXT Spain Leak: 114,934 Passwords Exposed. Yours Might Be One.

HEROIC analysts found a stealer log file uploaded to Telegram in July 2025 containing 114,934 records from Spain-based users. The dataset, labeled ULP KURTXT FRESH COUNTRY SPAIN 29-06-2025 Part 2, contained email addresses, plaintext passwords, and the URLs of the sites where each credential was captured. The collection was assembled from infostealer malware infections active in Spain in late June 2025 and distributed publicly through Telegram channels within days of collection.

Why This Is Dangerous for the 114,934 People in This Breach

With 114,934 email and plaintext password pairs in circulation, this dataset gives attackers a direct path into your accounts without any technical effort. They know your password exactly as you typed it, the site it belongs to, and your email address. That combination is enough to access banking apps, take over email inboxes and use them to reset every other password you have, log into employer systems if a work address was captured, and sell verified working credentials on dark web marketplaces within hours of the dump going live.

Data Exposed in the ULP KURTXT Spain Stealer Log

• Email Addresses
• Plaintext Passwords
• URLs (the exact websites where credentials were harvested)

Credential Stuffing, Account Takeover, and Identity Theft: What Criminals Do Next

With over 114,000 records in one file, this dataset is the kind of bulk inventory that fuels large-scale automated attacks. Criminals feed these credential pairs into stuffing tools that test them acros hundreds of banking, retail, and social media platforms simultaneously. Because password reuse is common, a single exposed credential can compromise dozens of accounts. Attackers also use plaintext password data for identity theft by accessing government portals, healthcare accounts, and financial services, and for fraud by exploiting saved payment methods and stored card details in e-commerce accounts.

What Is a ULP Stealer Log and How Did Spanish User Data End Up on Telegram?

ULP stands for URL-Login-Password, a structured format used by infostealer malware to organize harvested credentials. Malware families like RedLine, Vidar, and Lumma Stealer run silently on infected computers after arriving via phishing links, pirated software, or malvertising. Once installed, they extract saved browser passwords, capture active session tokens, and record the URL associated with each credential. The output is a ULP-formatted log file that is bundled and sold through affiliate networks or freely shared on Telegram. The KURTXT Spain Part 2 file represents one harvest batch targeting Spanish internet users, collectd in late June and uploaded to Telegram by early July 2025.

Check If Your Spanish Email Was Exposed: HEROIC Free Breach Scanner

HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including the KURTXT Spain stealer log collection and thousands of similar dumps. If your credentials appeared in this breach or any other in our database, you will be notified immediately so you can change passwords and secure your accounts before criminals act. Run your free scan at heroic.com right now. It takes under 30 seconds.