LeakBase 7.9M ULP by Firegoon Could Unlock Your Email and Bank
HEROIC analysts identified a credential dump posted to the hacking forum LeakBase on August 5, 2024, by a threat actor known as "firegoon," titled "7.9M ULP." The dataset contained approximately 8 million raw records, from which 2,658,306 unique email addresses were extracted alongside plaintext passwords and associated homepage URLs. The data was collected by credential-stealing malware running on infected user devices. This release is part of a broader pattern of stealer log dumps by the same actor, including LeakBase 8.7M ULP by firegoon, LeakBase 10Kk ULP by firegoon, and LeakBase 22Kk ULP by firegoon.
Why This Is Dangerous: Plaintext passwords need no cracking. Every one of the 2.6 million email-password pairs in this dataset can be tested immediately against any online service. The homepage URLs captured alongside each credential pair reveal which websites the victim was actively using, giving attackers a prioritized hit list of targets to try first. This kind of dataset fuels automated credential stuffing campaigns that can compromise email inboxes, bank accounts, and social media profiles within minutes of the data going public.
What Was Exposed
- Email addresses
- Plaintext passwords
- Homepage URLs
Why This Matters
Stealer logs containing plaintext credentials are the most immediately dangerous form of leaked data. There is no processing step between acquisition and exploitation. Attackers load the credential pairs into automated tools and test them across banking platforms, email providers, e-commerce sites, and corporate VPNs simultaneously. Successful logins are monetized by draining accounts, reselling access, or using compromised inboxes to launch phishing attacks against the victim's contacts. The homepage URLs in this dataset tell attackers precisely which services each victim uses, making their attacks more targeted and more likely to succeed.
How Stealer Logs Work
Stealer logs are produced by malware installed on a victim's computer through malicious downloads, phishing links, or compromised websites. The malware extracts saved passwords from browsers and applications, records the URLs of sites the user visits, and sends all of it back to the attacker. The attacker aggregates records from thousands of infected machines into a single log file and uploads it to a forum like LeakBase, where other criminals can download and exploit the data. Victims typically have no indication their device was infected until unauthorized account activity begins.
Check If You Are Affected
HEROIC's free breach scanner checks your email address against more than 400 billion compromised records, including this LeakBase 7.9M ULP dataset. See immediately whether your credentials were exposed and what actions to take. Scan your email for free now.
Related Parts of This Breach
The threat actor firegoon has posted numerous credential lists on LeakBase. Related dumps include:
Breach Breakdown
2,658,306 passwords exposed. Is yours one of them?
Enter your email to scan this breach plus 400B+ other leaked records. If you're compromised, we'll show you exactly where and what to change.
Free forever · No account required · Results in seconds
/img/qr-code.png)