5.7 Million Passwords From the LeakBase 44M ULP Dump Surfaced on Hacker Forums

HEROIC analysts discovered the LeakBase 44M ULP dataset on January 21, 2025, when it surfaced on a well-known hacking forum. The stealer log, posted by the threat actor FobiBoom, contained approximately 44 million total records. From that dataset, analysts confirmed 5,734,290 unique email addresses paired with plaintext passwords and associated homepage URLs. These credentials were harvested by infostealer malware from infected devices, not stolen from a single company, which makes this breach especially broad in scope.

Why Plaintext Passwords Make This Breach Particularly Dangerous

Most responsible services store passwords in a scrambled, unreadable format called a hash. Stealer logs like this one bypass that protection entirely because the malware captures your password at the moment you type it, before any hashing happens. That means every password in this dataset is ready to use, with no cracking required. An attacker can take your email and password combination and start attempting logins on dozens of sites within minutes. If you have ever reused a password across accounts, the risk compounds immediately.

What Was Exposed in the LeakBase 44M ULP Leak

• Email addresses (5,734,290 unique accounts confirmed)
• Plaintext passwords captured at the point of entry
• Homepage URLs identifying which sites the credentials belong to

Why This Matters Beyond a Single Login

Credential stuffing is the most direct threat here. Attackers load these email and password pairs into automated tools that test them against banking platforms, email providers, social media accounts, and workplace logins. If you have ever reused a password, a single compromised account can lead to a chain of takeovers. The homepage URLs in this dataset make it even easier for attackers because they already know exactly which service each credential belongs to, removing any guesswork from their attacks. Identity theft and financial fraud become real possibilities once an attacker controls your email account, since email is the recovery key for almost every online service.

How Stealer Logs Work

Stealer logs are produced by infostealer malware, a category of software that infects individual computers through phishing emails, pirated software, malicious ads, or fake browser extensions. Once installed, the malware silently monitors the device and captures credentials as they are entered into browsers or saved in password managers. It then packages everything, including login URLs, usernames, and passwords, into a structured file and sends it to the attacker. These logs are sold or traded on dark web markets and hacker forums. The LeakBase dataset is a compilation of thousands of such logs aggregated by FobiBoom and made available publicly in January 2025.

Check If Your Accounts Were Exposed

HEROIC's free breach scanner searches across more than 400 billion records, including stealer log datasets like this one. If your email address appears in the LeakBase 44M ULP dump or in any other known breach, HEROIC will tell you immediately. Enter your email at HEROIC.com to find out whether your credentials are circulating on the dark web right now, so you can change affected passwords before an attacker uses them.