Nullcyber Cloud Leak Leaves 334,343 Users Facing Account Takeover

The file ULP_10_10_2025Nullcyber_Cloud landed on Telegram on 10-Oct-2025 carrying 334,343 records inside, and now every one of those accounts is a potential target for takeover. That's the reality once a username and plaintext password pair ends up in the wrong hands.

Why This Is Dangerous

Account takeover isn't a hypothetical here, it's the most likely outcome for anyone whose login shows up in this file. Attackers don't need to guess or brute force anything when the password is already sitting right there in plain text, so the path from leak to takeover is shorter than usual.

What Was Exposed

Records from the Nullcyber Cloud file included:

• Email Addresses
• Plaintext Passwords
• URLs connected to each login
• 334,343 records exposed

Why This Matters

Once someone takes over an account, they can lock the real owner out, drain funds if a payment method is attached, or use the account to send phishing messages to everyone in the victim's contact list. The damage rarely stays contained to a seperate, single account for long, and will definately spread to linked services too.

How Stealer Logs Work

ULP style files like this one stand for "user, log, pass" combos harvested by infostealer malware running on an infected device. The malware watches for saved browser passwords and autofill fields, grabs them, and sends everything back to a central server before the victim ever recieves a hint that something is wrong.

Check If You Are Affected

If you want to know whether you're one of the 334,343 affected here, or caught up in a different leak entirely, HEROIC's free breach scanner checks your email against more than 400 billion records in seconds so you can act before an attacker does.