The Satanic 10M ULP Sept #9 Stealer Log Surfaced on BreachForums

HEROIC analysts identified a credential dump on BreachForums dated September 4, 2024, posted by the threat actor known as "Satanic." This release, labeled Private Satanic 10M ULP Sept #9, is the ninth installment in a ten-part series, each containing approximately 10 million records. From this installment, 2,537,089 unique records were confirmed, each consisting of an email address, a plaintext password, and a homepage URL. The broader series spans multiple releases by the same actor, including BreachForums Private Satanic 10M ULP Sept #1 by Satanic, BreachForums Private Satanic 10M ULP Sept #2 by Satanic, BreachForums Private Satanic 10M ULP Sept #4 by Satanic, and others.

The data in this release is structured in ULP format, meaning every record maps directly to a specific URL, a login email, and a plaintext password. Plaintext passwords require no decryption or cracking. They are ready to use the moment an attacker downloads the file. Combined with the homepage URLs that identify which services each credential belongs to, this dataset hands attackers a targeted list of working logins organized by destination. That combination is among the most operationally ready credential formats a threat actor can obtain.

What Was Exposed

• Email Address
• Plaintext Password
• HomePage URL

Why This Matters

Stealer log releases like this one fuel credential stuffing operations at scale. Automated tools ingest these email-password pairs and test them against hundreds of platforms simultaneously. Services with weak or absent multi-factor authentication are the most vulnerable. When a match is found, attackers gain full account access, enabling unauthorized purchases, identity theft, email account takeover for further phishing, and access to financial accounts. Password reuse across services multiplies the damage from a single exposed record. Across 2,537,089 records in this one release alone, the risk surface is substantial.

How Database Breaches Work

Stealer log databases like this one are typically assembled from infostealer malware infections. When a device is compromised, the malware scrapes credentials stored in browsers, password managers that are not properly secured, and session tokens. That data is exfiltrated to attacker infrastructure, aggregated into logs, and later sorted into ULP format before being posted or sold on underground forums. The logs themselves often originate from many separate infections across many different countries, which explains why a single release can include credentials for hundreds of different websites. The September 2024 timing of this series aligns with documented peaks in infostealer campaign activity.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of over 400 billion records, including stealer log compilations and credential dumps from underground forums. If your credentials appeared in the Private Satanic 10M ULP Sept #9 release or in any of the related parts of this series, changing your passwords and enabling two-factor authentication across your accounts is the most immediate protective step. Run a free exposure check at HEROIC now.

Related Parts of This Breach

• BreachForums Private Satanic 10M ULP Sept #1 by Satanic
• BreachForums Private Satanic 10M ULP Sept #2 by Satanic
• BreachForums Private Satanic 10M ULP Sept #4 by Satanic
• BreachForums Private Satanic 10M ULP Sept #5 by Satanic
• BreachForums Private Satanic 10M ULP Sept #6 by Satanic
• BreachForums Private Satanic 10M ULP Sept #7 by Satanic
• BreachForums Private Satanic 10M ULP Sept #8 by Satanic