Identity Theft Got Easier Because of the LeakBase 35Kk ULP Dump: 7 Million at Risk
HEROIC analysts identified the "35Kk ULP by farmagol" stealer log dump on January 4, 2025, posted to a prominent underground hacking forum. The dataset contained approximately 35 million raw records, of which 7,279,831 unique email addresses were confirmed, each paired with a homepage URL and a plaintext password. This is a stealer log compilation, meaning the credentials were harvested by malware silently running on infected devices, not from a single company breach. This dump is one of many in a series posted by the same threat actor, farmagol, across LeakBase forums.
Related dumps from this actor include: LeakBase 5Kk ULP by farmagol, LeakBase 50M ULP by farmagol, LeakBase 50M ULP Part 2 by farmagol, and LeakBase 32Kk ULP by farmagol.
Why This Is Dangerous
Stealer logs contain credentials taken directly from real devices at the moment of infection, which means the passwords are current, not years old. Pairing an email with a plaintext password and the site it was used on gives attackers a ready-made login attempt. They do not need to crack anything. Automated tools cycle through these credentials across hundreds of websites in minutes, a technique called credential stuffing. Any account where the victim reused the same password is immediately at risk.
What Was Exposed in the LeakBase 35Kk ULP Dump
- Email addresses (7,279,831 unique)
- Plaintext (unencrypted) passwords
- Homepage URLs (the site the credential was used on)
Why This Matters for Account Security
The scale of this dump, 7.2 million unique email and password pairs, means there is a meaningful probability that any active internet user could be affected. Credentials from stealer logs feed directly into credential stuffing attacks targeting banks, email providers, streaming services, and online retailers. Once an attacker controls an email account they can reset passwords on every linked service, enabling a cascading account takeover across a victim's entire digital life. Identity theft and financial fraud are the most common downstream consequences.
How Stealer Malware Credential Dumps Work
Stealer malware is typically delivered through phishing emails, malicious software downloads, or compromised websites. Once installed on a device, it silently scans for saved passwords in browsers, password managers, and applications, then transmits that data to the attacker's server. The attacker aggregates credentials from thousands of infected devices into a single log file, which is then sold, traded, or posted publicly on hacking forums. Because these passwords were captured live from the device, they are far more likely to be current and valid than data from older database breaches.
Check If Your Information Was Exposed
HEROIC monitors stealer log dumps and database breaches across over 400 billion compromised records. If your email address appears in the LeakBase 35Kk ULP dataset or any related farmagol dump, HEROIC's breach scanner will surface it. Visit heroic.com to check your exposure. If you are affected, immediately change the exposed password on every site where you used it, and enable two-factor authentication on your email account first.
Related Parts of This Breach Series
The threat actor farmagol posted multiple credential dumps to LeakBase forums. Other confirmed dumps in this series include:
Breach Breakdown
7,279,831 passwords exposed. Is yours one of them?
Enter your email to scan this breach plus 400B+ other leaked records. If you're compromised, we'll show you exactly where and what to change.
Free forever · No account required · Results in seconds
/img/qr-code.png)