Stealer Log Series Strikes Again: Logssupplier 1Kk ULP Part 6 Exposes 460K Records

On November 12, 2024, the threat actor known as 19890036580 posted another installment in an ongoing stealer log series to a prominent underground forum. Titled "1Kk ULP @Logssupplier (6)" and tracked under the LeakBase Logssupplier 1Kk ULP Part 6 dataset, this dump contained approximately 1 million total records exposing 460,016 unique email addresses paired with plaintext passwords and homepage URLs. The "Part 6" designation confirms this is not an isolated incident -- it is part of a recurring credential release operation that continues to grow.

Related Parts in This Series:
LeakBase logssupplier 1Kk ULP by LogLeader

Why This Is Dangerous

Serial stealer log releases are particularly alarming because they signal an active, sustained malware operation -- not a one-off incident. Each new part adds hundreds of thousands of fresh credentials to the pool available to cybercriminals. Because the passwords in this dump are stored in plaintext, they require zero additional effort to exploit. Victims whose credentials appear here face immediate risk across every service where they reuse that password.

What Was Exposed

• 460,016 unique email addresses
• Plaintext passwords -- fully readable, no cracking required
• Homepage URLs -- identifying the target sites from which credentials were harvested

Why This Matters

The Logssupplier series demonstrates that attackers are systematically harvesting and releasing credentials in batches -- a pattern consistent with a professional or semi-professional operation. Each release fuels fresh rounds of attacks against users across financial services, e-commerce, and communication platforms. Key risks include:

• Credential stuffing -- automated testing of these email/password combos across banking and retail sites
• Account takeover -- full compromise of email, social media, and subscription accounts
• Identity theft -- personal data extracted from hijacked accounts used to commit fraud
• Financial fraud -- unauthorized transactions and account draining

How Stealer Log Breaches Work

Infostealer malware -- variants like RedLine, Vidar, and Raccoon -- infects devices through phishing links, malicious downloads, and cracked software. Once active, the malware silently harvests credentials saved in browsers and applications, outputting them in URL-Login-Password (ULP) format. Operators then package these logs into numbered batches and distribute them on underground forums. The "@Logssupplier" handle used in the log title is consistent with a forum-based distribution persona, suggesting the same operator or network is behind multiple parts of this series.

Check If You Are Affected

Heroic's breach search engine indexes over 400 billion exposed records -- including all known parts of the Logssupplier stealer log series. Search your email address now to find out if your credentials were captured.

Search the Heroic Breach Database -- Free

Related Parts

• LeakBase logssupplier 1Kk ULP by LogLeader