Stealer Log Breach: Dragon_ULP 10 Exposes 2,707,310 Records

Not every data breach involves hackers breaking into a company's servers. Some, like the Dragon_ULP 10 incident uploaded to Telegram on June 1, 2026, come from a category called a stealer log, and this one alone accounts for 2,707,310 exposed records of email addresses, plaintext passwords, and URLs.

Understanding wich kind of breach you are dealing with matters, because a stealer log spreads differently and gets used differently than a typical company database leak.

Why This Is Dangerous

A stealer log breach means the passwords involved were pulled directly from people's own devices, already saved and ready to use, rather than encrypted in some company's database. That is why every one of the 2,707,310 records here shows up in plaintext, giving anyone who downloads the file instant, no effort access to try each login.

What Was Exposed

• Email addresses for 2,707,310 individuals
• Plaintext passwords attached to each record
• URLs showing the exact site or service each login belongs to
• 2,707,310 total records confirmed in the Dragon_ULP 10 file

Why This Matters

Recognizing this as a stealer log breach rather than a single company hack changes how you should respond. There is no one central business to send you a notification, since the credentials here were vacuumed up from many different accounts across many different services all at once, wich means the responsibility to check falls on you.

How Stealer Logs Work

A stealer log begins with malware quietly installed on a victim's computer, often disguised as a game cheat, cracked application, or fake update. It searches the browser for saved passwords, autofill entries, and session cookies, then bundles everything into one file that gets uploaded and traded, in this case as Dragon_ULP 10, on channels like Telegram.

Check If You Are Affected

Since stealer log breaches rarely come with an official notification, it is on each person to check for themselves. HEROIC's free breach scanner searches more than 400 billion breached records from across the dark web, giving you a fast, clear answer.