The LeakBase 27M ULP Dump Put 6.5 Million Plaintext Passwords on Hacker Forums

HEROIC analysts identified a large credential dump published on a widely known hacking forum on March 12, 2025. The dataset, known as the LeakBase 27M ULP dump and attributed to the threat actor handle 19890036580, contained approximately 27 million records in total. Of those, roughly 6,513,360 unique email addresses were matched with plaintext passwords and homepage URLs. Unlike breaches involving hashed credentials, this dump exposed fully readable passwords, meaning anyone who downloaded it could attempt to log into victims' accounts immediately, without any cracking required.

Why Plaintext Passwords Make This Dump So Dangerous

Most data breaches expose password hashes, which take time and computing power to reverse. This dump is different. The passwords in the LeakBase 27M ULP dataset are stored in plaintext, meaning they are written out exactly as the user typed them. Any attacker who obtained this file could attempt logins across email services, banking platforms, and social media accounts within seconds. The inclusion of homepage URLs also tells attackers which websites to target first, making this one of the most immediately actionable credential sets to circulate in early 2025. Users who reuse passwords across multiple sites face the highest exposeure risk.

What Was Exposed in the LeakBase 27M ULP Dump

• Email Address
• Plaintext Password
• HomePage URL

Why This Matters for Anyone Whose Credentials Were Included

Credential stuffing attacks powered by dumps like this one are responnsible for a significant share of account takeovers worldwide. Attackers feed stolen email and password pairs into automated tools that test them against dozens of popular websites simultaneously. If the same password is used on multiple platforms, a single leaked credential can unlock a banking account, an email inbox, a shopping account, and more. Beyond account takeover, leaked email addresses and associated URLs become targeting data for phishing campaigns, increasing the likelihood that affected users receive convincing fraud attempts.

How Stealer Log Dumps Work

Stealer logs are collections of credentials and browsing data harvested by malware installed on victims' computers. The malware, often delivered through phishing emails or malicious downloads, silently records usernames and passwords as the user types them into websites. It then transmits this data back to the attacker. The harvested credentials are bundled into log files and sold or shared on underground forums. The "ULP" designation stands for URL, Login, Password, the standard three-column format used to organize these files. The LeakBase 27M ULP dump follows this pattern exactly, offering attackers a ready-to-use credential list with site targets already identified.

Check If Your Email Was in This Dump

HEROIC's free breach scanner searches across more than 400 billion compromised records, including stealer log collections like the LeakBase 27M ULP dump. If your email address appeared in this dataset, you need to change your password immediately on every site where you use the same credentials. Run a free check at HEROIC.com to find out whether your information has been exposed.