The DRAGON_ULP 13 Data Breach Exposed Nearly 1 Million Email Logins

In June 2026, HEROIC analysts recovered a combolist labeled PRIVATE ULP BY DRAGON_ULP 13 that a Telegram user uploaded. The file contains 970,617 records, each pairing an email address with a plaintext password and the URL those credentials were captured from. It was uploaded on 03-Jun-2026 and is now indexed in HEROIC's dark web monitoring database.

Why This Is Dangerous

This file follows the ULP format, short for URL, Login, Password, which is built for speed rather than secrecy. There's no encryption and no cracking needed. An attacker can load nearly a million ready-to-use email and password pairs straight into automated login tools and start testing them immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs the credentials were associated with

Why This Matters

With close to a million records in one file, this combolist is a large-scale credential stuffing tool. If anyone in this list reused a password for their email, banking, or social media, an attacker gains a direct path into those accounts too. At this scale, that risk translates into widespread account takeover, financial fraud, and identity theft.

How This DRAGON_ULP Combolist Was Built

Combolists like this one are assembled by pulling credentials from prior breaches, stealer logs, and scraped login data, then formatting everything into the URL, Login, Password structure that makes bulk testing efficient. Large private combolists like this one are typically traded first in closed Telegram groups before circulating more widely, which is where HEROIC analysts recovered this file.

Check If You Are Affected

With nearly a million records in this one file alone, don't assume you're not affected. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including this DRAGON_ULP 13 combolist, and tells you instantly if you've been exposed. Run a free scan now and change any passwords you may have reused.