Search Your Email: The Satanic 10M ULP Part 2 Sept #3 Dump Exposed 2.1 Million Accounts

HEROIC analysts identified this data on September 12, 2024, when a threat actor known as "Satanic" posted the third installment in a ten-part credential series to BreachForums. The dump, titled "Private Satanic 10M ULP Part 2 Sept #3," exposed 2,151,346 records containing email addresses, plaintext passwords, and homepage URLs. This release was part of a sustained campaign: the same actor had already distributed a separate ten-part series the week before, and this was the third of ten new logs released in rapid succession. Other documented parts of this series include Satanic 10M ULP Part 2 Sept #10 and Satanic 10M ULP Part 2 Sept #9.

Over two million records with plaintext passwords represent a severe and immediately actionable threat. Plaintext passwords need no additional processing before they can be tested against live services. Paired with the email address for each record and the homepage URL pointing to the source platform, attackers have a complete picture: who the victim is, what they use, and exactly which password to try. This data is precisely what automated credential stuffing tools are designed to consume.

What Was Exposed

• Email Address
• Plaintext Password
• HomePage URL

Why This Matters

Credential stuffing attacks depend on one well-documented behavior: password reuse. When someone uses the same password across multiple accounts, a single exposure can lead to takeovers on banking platforms, email services, corporate systems, and personal accounts all at once. Email account takeover is especially serious, because it allows an attacker to intercept password-reset messages and gain access to every other service registered to that address. At the scale of 2.1 million records, this dump fuels fraud, identity theft, and unauthorized account access across a wide range of online services.

How Database Breaches Work

This dump is classified as a stealer log, a format produced by infostealer malware running on compromised end-user devices. The malware harvests credentials silently from browser-saved passwords, autofill stores, and active login sessions, then sends that data to attacker-controlled servers. Thousands of individual device infections are aggregated into bulk logs organized in ULP (URL, Login, Password) format. Those logs are then distributed on underground platforms such as BreachForums, where other criminals use them to conduct credential stuffing campaigns or sell them for profit. The sequential, numbered release pattern used by the Satanic actor here is a deliberate strategy to maximize distribution and visibility of the stolen data.

Check If You Are Affected

HEROIC's free breach scanner checks your email against a database of more than 400 billion exposed records. If your address appeared in the Satanic 10M ULP Part 2 Sept #3 dump or any of the thousands of other breaches in the HEROIC database, you will see the results immediately. Visit heroic.com to run a free check and find out which of your accounts may be at risk.

Related Parts of This Breach

• BreachForums Private Satanic 10M ULP Part 2 Sept #10 by Satanic
• BreachForums Private Satanic 10M ULP Part 2 Sept #9 by Satanic
• BreachForums Private Satanic 10M ULP Part 2 Sept #7 by Satanic
• BreachForums Private Satanic 10M ULP Part 2 Sept #5 by Satanic
• BreachForums Private Satanic 10M ULP Part 2 Sept #6 by Satanic
• BreachForums Private Satanic 10M ULP Part 2 Sept #2 by Satanic
• BreachForums Private Satanic 10M ULP Part 2 Sept #1 by Satanic
• The Satanic 10M ULP Part 2 Sept #8 Stealer Log
• The BreachForums Private Satanic 10M ULP Part 2 Sept #4 Dump