The Nullcyber_Cloud Leak: 398,955 Passwords Exposed. Yours Might Be One.

HEROIC analysts found the Nullcyber_Cloud ULP stealer log circulating on Telegram in October 2025. The archive contained 398,955 records exposing email addresses, plaintext passwords, and URLs pulled directly from compromised devices. The file was labeled as a private ULP collection, suggesting it originated from a paid or restricted criminal distribution channel before being more widely shared. At nearly 400,000 records, this is a large-scale credential exposure with significant reach across potentially hundreds of different services and platforms.

Why Nearly 400,000 Exposed Records in Plaintext Is a Serious Threat

When passwords are stored in plaintext rather than hashed, attackers need zero additional effort to use them. There is no cracking process, no waiting, and no technical skill required. The moment this file was shared on Telegram, every email and password pair became immediately weaponizable. Combined with the URLs showing exactly which websites each credential belongs to, attackers have a fully indexed list of accounts ready to compromise. Anyone whose credentials appear in this archive faces account takeover risk on every service where they reuse that password.

Data Exposed in the Nullcyber_Cloud ULP Telegram Leak

• Email Addresses — account identifiers across banking, social, shopping, and work platforms
• Plaintext Passwords — fully readable, no decryption required, immediately usable by any attacker
• URLs — the specific websites each stolen credential pair was assosciated with at the time of theft

The Cascading Attacks That Follow a 400,000-Record Credential Dump

• Credential stuffing — automated tools cycle through all 398,955 pairs across major platforms in minutes
• Account takeover — attackers change passwords and lock victims out before they receive any alert
• Identity theft — email access opens the door to resetting passwords on financial accounts, government portals, and healthcare systems
• Financial fraud — stored payment methods and active banking sesions are exploited immediately after access is gained

What Nullcyber_Cloud Tells Us About How Private Stealer Log Markets Work

The "Private" designation in this file's name is a telling detail. On Telegram and dark web forums, stealer log operators often sell access to "private" or "exclusive" credential archives at a premium before eventually releasing them more broadly. These private channels operate like subscription services — buyers pay for early or exclusive access to fresh credential dumps before they become widely known and defenders can respond. The Nullcyber_Cloud file appears to have followed this pattern, originaly sold or shared in restricted channels before reaching a wider audience. By the time a private log becomes public, months of undetected account access may have already occured. The October 2025 date on this file means many victims were exposed long before this data became part of the public breach record.

Check If Your Email Was in the Nullcyber_Cloud Leak or 400 Billion Other Records

HEROIC's free breach scanner searches more than 400 billion compromised records, including private stealer log archives like the Nullcyber_Cloud ULP dump. If your email address appeared in this file, HEROIC will identify exactly what data was exposed and from which source. Run your free scan at HEROIC.com and take action before attackers do.