Satanic 10M ULP Sept #4 Put 2.7 Million Stolen Passwords Online

HEROIC analysts identified a stealer log on BreachForums dated September 4, 2024, released by the threat actor known as "Satanic." This release, labeled Private Satanic 10M ULP Sept #4, is the fourth part in a ten-part series. The dataset contains 2,739,811 unique records, each pairing an email address with a plaintext password and a homepage URL. Related parts of this series can be found here: BreachForums Private Satanic 10M ULP Sept #1 by Satanic, BreachForums Private Satanic 10M ULP Sept #2 by Satanic, BreachForums Private Satanic 10M ULP Sept #5 by Satanic, and others.

This dataset is formatted as a ULP log, meaning each record contains the URL of the targeted service, the account login email, and the associated plaintext password in a single line. That structure removes all friction for an attacker. The login portal is identified, the credentials are ready, and no technical skill is required to begin testing them. With 2,739,811 such records available, the potential for mass account takeover operations is direct and immediate.

What Was Exposed

• Email Address
• Plaintext Password
• HomePage URL

Why This Matters

Every plaintext credential in a breach like this is immediately usable by any attacker who obtains the file. Credential stuffing attacks automate the process of testing these pairs across dozens of popular services at once. The combination of email address, password, and target URL means attackers already know where to point their tools. For individuals who reuse passwords across banking, email, social media, or work accounts, a single exposed record represents a potential cascade of unauthorized access. Financial fraud, identity theft, and account lockouts are common outcomes for victims of credential stuffing from stealer log datasets.

How Database Breaches Work

Stealer logs are produced by infostealer malware that infects computers through phishing emails, fake software downloads, and malicious browser extensions. Once installed, the malware operates silently and collects every credential saved in the browser, along with the URLs those credentials belong to. That data is sent back to attacker infrastructure, compiled into structured logs, and distributed on underground forums. The consistent use of the ULP format across all ten parts of this series indicates a standardized workflow, suggesting the actor either built or purchased an established infostealer operation rather than operating ad hoc.

Check If You Are Affected

HEROIC provides a free breach scanner that searches across a database of over 400 billion records to identify whether your email address has appeared in known credential dumps, stealer logs, or dark web releases. If your data was included in the Private Satanic 10M ULP Sept #4 release or any related part of this series, changing compromised passwords and enabling two-factor authentication on affected accounts is the most effective immediate response. Check your exposure for free at HEROIC.

Related Parts of This Breach

• BreachForums Private Satanic 10M ULP Sept #1 by Satanic
• BreachForums Private Satanic 10M ULP Sept #2 by Satanic
• BreachForums Private Satanic 10M ULP Sept #5 by Satanic
• BreachForums Private Satanic 10M ULP Sept #6 by Satanic
• BreachForums Private Satanic 10M ULP Sept #7 by Satanic
• BreachForums Private Satanic 10M ULP Sept #8 by Satanic
• BreachForums Private Satanic 10M ULP Sept #9 by Satanic