8.27 Million Logins Leaked: Niflheim Horizon Clouds 38M ULP Breach

HEROIC analysts found that on July 16, 2024, a stealer log named "Horizon Clouds 38M ULP" was posted on the Niflheim underground forum by the threat actor ComboPoster. The leak exposed 8,271,295 unique records drawn from an estimated 38 to 39 million total entries, each pairing an email address with a plaintext password and an associated HomePage URL. To put the scale in perspective, 8.27 million records is roughly equivalent to the entire population of Switzerland being handed over to cybercriminals in a single file. The United States is listed as the primary country of impact.

Why This Is Dangerous

Stealer logs that combine email addresses, plaintext passwords, and homepage URLs are among the most operationally dangerous credential datasets in circulation. Plaintext passwords require no decryption, meaning any actor who downloads this file can immediately begin testing credentials against live services. The URL field narrows which services a victim uses, allowing attackers to skip guesswork and go straight to targeted account takeover attempts.

What Was Exposed

• Email Address
• Plaintext Password
• HomePage URL

Why This Matters

Credential stuffing, account takeover (ATO), identity theft, and financial fraud are the direct downstream risks from a leak of this type. Automated toolkits available on underground markets can process millions of credential pairs per hour, testing them against banking, e-commerce, email, and social media platforms. Victims who reuse passwords across services face the highest risk: a single exposed password can cascade into multiple simultaneous account compromises. The included URLs tell attackers exactly where to strike first.

How Database Breaches Work

This leak originates from infostealer malware infections across many individual user devices. Stealer malware is typically distributed through phishing emails, malicious browser extensions, or trojanized software downloads. Once active on a device, the malware extracts saved credentials from browsers and applications, packages them with associated URLs, and transmits the data to attacker-controlled servers. These records are then aggregated into bulk logs and published or sold on forums like Niflheim, where they reach a wide criminal audience quickly.

Check If You Are Affected

HEROIC offers a free dark web scanner backed by more than 400 billion compromised records, including stealer logs of this type. If your email address was captured in the Niflheim Horizon Clouds 38M ULP leak, your password for the associated service and any others where you reuse it should be changed immediately. Enable two-factor authentication wherever possible. Visit heroic.com to run a free scan now.