Researchers Trace the Xavier_Ulp Leak to 128,808 Exposed Passwords

HEROIC analysts traced a file labeled Xavier_Ulp - 303451, part of a larger archive series called Xavier_Group, that was uploaded to a Telegram channel on 16 July 2026. The "Ulp" in the file name stands for User, Login, Password, a common shorthand for combined credential lists. This particular batch contains 128,808 records, each pairing an email address with a plaintext password and the specific URL where that login was captured.

Why This Is Dangerous

A file this size is not a random scrape, it is a structured, ready-to-use list of working logins. Because every record already includes the exact site URL alongside the email and password, an attacker does not need to guess where a credential works. They can load the file into automated tools and start testing accounts across email providers, online stores, and financial platforms within minutes of downloading it.

What Was Exposed in the Xavier_Ulp File

• Email addresses for 128,808 accounts
• Plaintext passwords stored alongside each email
• The login URLs tied to each set of credentials

Why This Matters

At nearly 129,000 records, this file gives attackers a large enough pool to run wide-scale credential stuffing campaigns, automatically trying each email and password pair against dozens of popular services. Because so many people reuse the same password across multiple accounts, a login stolen from one site often opens the door to email, banking, or shopping accounts elsewhere. That is how a single stealer log turns into identity theft or financial fraud for thousands of people at once.

How a Combolist Like Xavier_Ulp Comes Together

Files like this typically start as raw stealer logs, credentials pulled from devices infected with password-stealing malware. Someone then aggregates those individual logs into a single structured list, formatting each entry into the "Ulp" pattern of user, login, and password so it can be sold or shared as one clean file. Naming it as part of a series, like Xavier_Group, suggests this is one of several related batches the same source has released, each one adding more compromised accounts to circulation.

Check If You Are Affected

With more than 128,000 accounts in this single file, the odds that your email address is included are far from negligible. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including combolists like Xavier_Ulp, so you can find out quickly whether your credentials are circulating and change your passwords before they are used against you.