The LeakBase 20M ULP Breach Targeted 4.1 Million Email Users
HEROIC analysts identified a large credential dump posted to the hacking forum LeakBase on August 5, 2024, under the name "20M ULP by 1212123." The dataset contained approximately 40 million raw records, from which 4,102,844 unique email addresses were extracted alongside plaintext passwords and associated homepage URLs. The data appears to have been harvested by credential-stealing malware from infected user devices rather than from a single compromised organization. Other stealer log dumps by the same actor and related actors on the same platform include LeakBase Beast 60M ULP by 1212123.
Why This Is Dangerous: Plaintext passwords require no cracking. Anyone who downloads this dataset can immediately attempt to log into every email, banking, social media, and shopping account associated with the exposed addresses. The homepage URLs recorded alongside each credential pair reveal which specific websites the victim was logged into when the malware ran, giving attackers a precise list of high-value targets to hit first. With over four million ready-to-use credential pairs, this dataset is a ready-made toolkit for large-scale account takeover operations.
What Was Exposed
- Email addresses
- Plaintext passwords
- Homepage URLs
Why This Matters
Stealer logs containing plaintext credentials are among the most immediately actionable data types in the criminal underground. Unlike hashed passwords, they require no processing before use. Attackers run the email-password pairs through automated credential stuffing tools against hundreds of popular websites simultaneously. Successful logins are then sold as "account accesses" on dark web marketplaces, used to drain financial accounts, harvest loyalty points, or serve as launchpads for business email compromise attacks. The homepage URLs in this dataset amplify the threat by telling attackers exactly where each victim is most active online.
How Stealer Logs Work
A stealer log is a file produced by credential-stealing malware installed on a victim's device, typically through a malicious email attachment, a fake software download, or a drive-by exploit on a compromised website. Once running, the malware silently extracts saved usernames and passwords from web browsers, records the URLs of sites visited, and transmits the collected data to the attacker's server. The attacker then compiles thousands or millions of these records into a single "log" file, which is packaged and sold or shared on hacking forums. The victims are often unaware their credentials were stolen until they notice unauthorized activity on their accounts.
Check If You Are Affected
HEROIC's free breach scanner checks your email address against more than 400 billion compromised records, including this LeakBase 20M ULP dataset. If your credentials appear in this dump, you will receive an immediate alert. Scan your email for free now.
Related Parts of This Breach
The actor behind this dump and related actors have posted additional credential lists on LeakBase. See related datasets below:
Breach Breakdown
4,102,844 passwords exposed. Is yours one of them?
Enter your email to scan this breach plus 400B+ other leaked records. If you're compromised, we'll show you exactly where and what to change.
Free forever · No account required · Results in seconds
/img/qr-code.png)