144 Million Lines. One Leak. The LeakBase 144M ULP Had 15.5M Records.

One forum post. 144 million lines. On December 6, 2024, a stealer log appeared on a well-known underground forum under the title "144M Url Login Pass (Not Mine)" -- an unusually candid attribution disclaimer that did nothing to reduce the damage. The dataset, attributed to the actor 19890036580 and cataloged as the LeakBase 144M ULP, contained approximately 144 million raw lines and yielded 15,531,939 unique email addresses, each paired with a plaintext password and the associated homepage URL. At 15.5 million unique accounts, this stands as one of the larger single-file credential dumps observed on LeakBase during late 2024, and the plaintext nature of every password means there is zero processing delay between download and exploitation.

Why This Massive Stealer Log Is Dangerous

Scale changes the threat calculus. A dump of 15.5 million plaintext credential triplets does not just expose individual users -- it floods the credential stuffing ecosystem with enough verified combinations to sustain automated attack campaigns for months. Each email-password-URL combination in the LeakBase 144M ULP provides attackers with three simultaneous attack vectors: a direct login attempt at the URL in the record, a cross-platform stuffing attempt using the same password elsewhere, and a phishing anchor targeting the victim's known account at a specific service. The title's parenthetical -- "Not Mine" -- suggests the actor may have aggregated this data from other sources, which could mean the underlying infostealer campaigns spanned an extended period and a broad geographic range.

What Was Exposed

• Email Addresses -- 15,531,939 unique accounts, each a direct attack target for login attempts, phishing, and social engineering
• Plaintext Passwords -- 144 million raw lines of unencrypted credentials, zero cracking overhead, immediately deployable in automated tools
• Homepage URLs -- the exact site associated with each credential, enabling precise account targeting rather than blind stuffing

Why This Matters

A plaintext credential dump at this volume enables every major category of follow-on attack:

• Credential stuffing at industrial scale -- 15.5 million pairs cycle through banking, email, and e-commerce platforms via automated bots, generating account takeovers within hours of the dump going public
• Direct account takeover -- attackers target the specific site in each URL field first, where the password was actively used and likely not yet changed
• Identity theft -- email access enables password resets on every linked financial, health, and government account
• Fraud -- unauthorized purchases, wire transfers, benefits claims, and tax fraud all become feasible once an attacker controls a primary email account

How a 144 Million Line Stealer Log Is Built

Logs of this size are typically not the product of a single infostealer campaign. They are aggregations -- collections assembled by purchasing or trading smaller logs from multiple actors operating infostealer malware across different regions and time periods. The title "Not Mine" reinforces this interpretation: the posting actor may have compiled data sourced from others. Infostealer malware (tools like Redline, Raccoon, and Vidar) installs on victims' devices via phishing, malicious downloads, or compromised software updates. The malware silently extracts saved browser credentials and transmits them to attacker infrastructure. Those raw logs are then bought, merged, deduplicated, and repackaged into large compilations like the LeakBase 144M ULP before being posted to forums for reputation, sale, or free distribution.

Check If You Are Affected

With 15.5 million unique email addresses in a single dump, the probability that your credentials -- or those of employees in your organization -- appear in the LeakBase 144M ULP is significant. HEROIC's breach intelligence database indexes over 400 billion compromised records, including large-volume stealer log compilations like this one.

Run a free email search at heroic.com to check your exposure in seconds. Organizations should activate continuous domain monitoring to receive immediate alerts whenever any employee email address surfaces in a new breach of any size.