Researchers Flag LeakBase 11.4Kk ULP by firegoon Credential Dump

On June 10, 2024, a researcher monitoring underground forums observed a new entry in the ongoing LeakBase ULP series posted by the prolific threat actor firegoon. This particular dump, titled "LeakBase 11.4Kk ULP by firegoon," contained 1,461,010 unique email addresses, each accompanied by a plaintext password and a homepage URL. HEROIC analysts confirmed the exposure through independent verification against our breach intelligence platform. The firegoon series spans dozens of separate log files posted across the same period, collectively representing one of the larger sustained credential leak campaigns observed on underground forums in mid-2024. Sibling entries from the same series are documented and linked below.

Why This Is Dangerous

Over 1.4 million plaintext credentials represent an immediately deployable attack resource. No decryption or cracking is required. Automated credential stuffing tools can process this volume of logins in hours, testing them against streaming platforms, financial institutions, corporate VPNs, and email providers simultaneously. The homepage URL field adds a layer of intelligence that helps attackers segment targets, focusing first on victims associated with high-value services. The scale of this single dump alone is sufficient to fuel months of account takeover campaigns.

What Was Exposed

• Email Address
• Plaintext Password
• HomePage URL

Why This Matters

The downstream consequences of a plaintext credential leak at this scale are significant. Credential stuffing attacks against unrelated services are the most immediate risk, particularly for victims who reuse passwords. Successful account takeovers can lead to financial fraud, unauthorized purchases, and identity theft. Corporate email accounts compromised through reused credentials can give attackers a foothold for business email compromise schemes. Even victims who do not reuse passwords face heightened phishing risk, as their email addresses are now confirmed active and associated with real online accounts.

How Database Breaches Work

Stealer log-format database breaches occur when infostealer malware, deployed via phishing emails, malicious downloads, or compromised software, runs silently on a victim's device and extracts saved credentials from browsers and applications. These credentials are transmitted back to the attacker's infrastructure, compiled into structured log files, and eventually sold or published on underground forums. The "ULP" format, standing for URL-Login-Password, is a standardized structure used in the stealer log ecosystem that pairs each credential with the URL of the site where it was captured, making the data immediately useful for targeted attacks.

Check If You Are Affected

HEROIC's free breach scanner searches across more than 400 billion exposed records to determine whether your email address has appeared in this dump or any other known breach. Visit heroic.com to run your free scan. If your credentials are found, HEROIC provides clear next steps to secure your accounts before attackers can exploit them.

Related Parts of This Breach

This entry is part of the broader firegoon LeakBase ULP series. Other documented parts include LeakBase 6.5Kk ULP #2 by firegoon, LeakBase 10Kk ULP by firegoon, LeakBase 15Kk ULP #4 by firegoon, and additional entries spanning the full campaign.