How the StarX ULP Series Grew to 5.65 Million Stolen Logins

HEROIC analysts tracked a second file from the March StarX ULP series, StarX_ULP_08.03.2026_Part_2, uploaded by the same Telegram user on 8 March 2026. This part adds 5,657,003 records of email addresses, plaintext passwords, and matching URLs, bringing the two March parts to a combined total of more than 11 million exposed credential pairs.

How the StarX ULP Series Grew to Over 11 Million Logins

Rather than releasing one massive file, the person behind StarX has published this data in sequential parts across February and March, each one containing millions of email, password, and URL combinations. This staged release pattern lets stolen credentials reach a wider audience over time and makes it harder for defenders to track the full scope of the leak until every part has surfaced.

What Was Exposed in StarX ULP Part 2

• Email addresses
• Plaintext passwords
• URLs identifying the exact site each login unlocks

Why This Matters for the 5.65 Million Records in This Part

Every record in this file is ready for immediate use in credential stuffing attacks, since the plaintext password and matching URL remove the need for any additional work by an attacker. Anyone whose login appears here, especially if they reuse the same password on other sites, faces a real risk of account takeover, identity theft, or fraud carried out through their own credentials.

How a ULP Series Like StarX Is Built and Released

A ULP file organizes credentials by URL, login, and password specifically so automated tools can use them without manual sorting. Releasing a series across multiple dates and parts, as seen with StarX, suggests an ongoing operation collecting stolen credentials from various sources and packaging them for sale or distribution on Telegram in batches as the data accumulates.

Check If Your Login Is in the StarX March Leak

With two March parts of the StarX series now public, alongside the earlier February batches, the odds that your email appears somewhere in this series keep growing. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including this StarX dump, so you can find out immediately and secure any accounts before someone else gets there first.