Identity Theft Just Got Easier: The MoonULP Leak Exposed 13.8M Logins

HEROIC analysts discovered a large combolist called MoonULP after it was uploaded to a Telegram channel on May 13, 2026. The file contains 13,844,147 records, each pairing an email address with a plaintext password and the URL of the website the login belongs to, making it one of the larger stolen credential dumps HEROIC has tracked recently.

Why the MoonULP Leak Is Dangerous

At nearly 14 million entries, MoonULP gives attackers an enormous, ready-to-use list of working logins. Because the passwords are stored in plaintext and each record is already matched to the site it unlocks, there is no technical skill required to use this data. Anyone who downloads the file can start testing logins against real accounts immediately.

What Was Exposed in the MoonULP Dump

• Email addresses
• Plaintext passwords
• URLs identifying the associated website for each login

Why This Matters for 13.8 Million People

Passwords rarely stay confined to one account. When a credential from MoonULP matches a password someone has reused elsewhere, an attacker can pivot from one compromised site into email, banking, and social media accounts. At this scale, criminals often run the entire file through automated tools rather than targeting individuals, which means identity theft and financial fraud can happen to victims who never even interacted with the attacker directly.

How a Combolist Like MoonULP Is Built

Combolists are assembled by combining login data pulled from older breaches, phishing pages, and malware-infected devices into one large file, then sorting the entries by the website each one unlocks. A combolist the size of MoonULP is typically stitched together from many smaller sources over time before being packaged and distributed on Telegram, where it can be downloaded and reused by anyone.

Check If You Are Affected by the MoonULP Breach

With 13.8 million records now circulating, the odds that your email address is included are real. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including the MoonULP dataset, so you can confirm your exposure and secure any reused passwords right away.