STARLINKULP Breach Quietly Exposes 4.1 Million Passwords

In October 2025, HEROIC analysts found a stealer log file named STARLINKULP quietly circulating on a Telegram channel. It contained 4,164,328 records of email addresses, plaintext passwords, and the website URLs those logins belong to, all harvested directly from infected devices.

A Number That Deserves a Closer Look

Four million login combinations is not a headline grabbing hack against a single company. It is something arguably worse: a slow accumulation of stolen credentials from ordinary people's own computers, bundled together and handed out for free.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated website URLs

Why This Matters

Every entry in this file is a ready made key. Because passwords are stored in plaintext and matched to the exact site they unlock, attackers can skip the guesswork entirely. This makes credential stuffing fast, cheap, and scalable, and it feeds directly into account takeover, identity theft, and financial fraud for anyone who reused a password.

How This Stealer Log Was Built

Logs like STARLINKULP come from malware quietly installed through pirated software, fake game cheats, or malicious downloads. Once active, the malware pulls saved passwords and autofill data straight from the browser, then ships it back to the attacker in bulk. Millions of records can accumulate this way in just a few months, which is exactly what seems to of happened here.

Check If You Are Affected

With over four million records in this single file, the odds that your information is included are real. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can find out in seconds and secure your accounts before someone else uses them.