9.1 Million Plaintext Passwords Leaked in LeakBase Golden Eagle Cloud Breach

HEROIC analysts flagged a high-risk stealer log on June 1, 2024, posted to a prominent hacking forum under the name LeakBase Golden Eagle Cloud 60M ULP by direct. The log contained 9,154,839 unique records, each pairing an email address with a plaintext password and a homepage URL. Plaintext passwords require no cracking — they are immediately usable by any attacker who downloads the log.

Why This Is Dangerous

Unlike breaches involving hashed passwords, this exposure puts credentials directly into attackers' hands with zero additional effort. The "ULP" format (URL, Login, Password) is specifically designed for credential stuffing tools. Attackers can load these records into automated bots that systematically attempt logins across hundreds of websites within hours of the log being posted. The homepage URLs also reveal which services victims were actively using, allowing attackers to prioritize high-value targets like banking and e-commerce platforms.

What Was Exposed

• Email Address
• Plaintext Password
• HomePage URL

Why This Matters

Credential stuffing attacks powered by ULP logs are responsible for millions of account takeovers every year. When the same email and password combination is reused across multiple sites — a common habit — a single leak unlocks access to banking portals, email inboxes, social media accounts, and shopping platforms. Account takeover leads directly to financial fraud, unauthorized transactions, and the harvesting of additional personal data stored in victim accounts. The scale of 9,154,839 affected records means this log represents a significant threat to a large number of individuals.

How Stealer Logs Work

Stealer logs are collections of credentials harvested by infostealer malware installed on victims' devices. The malware captures passwords as they are typed or retrieved from browser password managers, then bundles them with associated URLs and account identifiers. These logs are aggregated by operators like LeakBase and distributed on hacking forums — sometimes sold, sometimes posted freely to build reputation. The "by direct" designation in this source name indicates the data was obtained through a direct exfiltration method rather than an intermediary.

Check If You Are Affected

HEROIC's free breach scanner searches over 400 billion compromised records, including stealer log data, to determine whether your credentials have been exposed. If your email address appeared in the LeakBase Golden Eagle Cloud log or any other known breach, you will be notified immediately. Visit heroic.com to scan your email address for free.