Our Analysts Found the LeakBase Private 26M ULP Dump on a Hacking Forum

HEROIC analysts found the LeakBase Private 26M ULP by selinatest stealer log circulating on a prominent hacking forum on July 28, 2024. The dataset contains 2,250,547 unique records drawn from approximately 26 million total entries, with each record pairing an email address with a plaintext password and an associated homepage URL. A closely related credential dump appeared on the same platform just one day later: LeakBase [20M] ULP by savbal.

Why This Is Dangerous

Plaintext passwords in a stealer log like this one require no decryption or cracking effort. An attacker can immediately load these credentials into automated tools and begin testing them against email providers, banks, retailers, and social media platforms. The homepage URLs embedded in each record act as a roadmap, telling attackers exactly which service each credential belongs to, allowing them to prioritize high-value targets. For victims who reuse passwords, a single exposed pair can unlock access to dozens of accounts within hours of the log being published.

What Was Exposed

• Email Address
• Plaintext Password
• HomePage URL

Why This Matters

Credential stuffing attacks fueled by dumps like this one are one of the most common causes of account takeover. Because most people reuse passwords, a single confirmed credential pair opens the door to financial fraud, identity theft, and unauthorized access across multiple platforms. Victims often do not discover the compromise until they are locked out of an account or notice unauthorized transactions. The scale of this dump, 2.25 million unique records, means a large number of individuals are at immediate risk and may already be under active attack.

How a Stealer Log Breach Works

Stealer logs are compiled by information-stealing malware that silently runs on infected computers. The malware is typically distributed through phishing emails, pirated software, or malicious browser extensions. Once installed, it captures login credentials as users type them, extracts saved passwords from browser stores, and harvests active session cookies. The collected data is formatted into URL:Login:Password (ULP) lists and uploaded to hacking forums by the malware operator or resold to other threat actors. Each entry in the log represents a real person whose device was compromised and whose credentials were stolen without their knowledge.

Check If You Are Affected

If your email and password appear in this log, your accounts may already be under attack. Use the HEROIC free identity scanner to check your email address against our database of over 400 billion exposed records and find out whether your credentials were included in this dump or any other known breach.

Related Parts of This Breach

• LeakBase [20M] ULP by savbal - 2,333,712 unique records exposed on LeakBase on July 29, 2024