Account Takeover Just Got Easier Because of TXTLOG_ALIEN: 41 Million Passwords Exposed on BreachForums

HEROIC analysts identified a massive credential dataset posted to BreachForums on January 23, 2025, by a threat actor operating under the handle txtlog_alien. The collection, titled TXTLOG_ALIEN 301M ULP, contained approximately 301 million credential records structured in URL:Login:Password format. After deduplication, the dataset exposed 41 million unique email addresses, each paired with a plaintext password and the URL of the targeted service. This is one of the largest single ULP dumps recorded in early 2025, and the scale alone puts tens of millions of people at direct, immediate risk of account takeover.

Why 41 Million Plaintext Passwords on BreachForums Change the Risk Equation

Most credential leaks require attackers to crack hashed passwords before they can be used. Not this one. Every password in the TXTLOG_ALIEN 301M dataset is already in plaintext, immediately usable against any site listed in the corresponding URL column. With 41 million unique email addresses and 301 million total records, this dataset is large enough that statistically, most households with internet users have at least one affected account. The BreachForums distribution also means that thousands of threat actors downloaded the file within hours of it being posted, multiplying the attack surface before most individuals knew anything had happened.

What Was Exposed in the TXTLOG_ALIEN 301M ULP Collection

• Email addresses (41 million unique accounts)
• Plaintext passwords
• HomePage URLs identifying which services the credentials belong to

The URL field in each record makes this dataset especially dangerous. Attackers do not need to guess which platforms to attack. Every record already tells them exactly where each set of credentials is valid, eliminating the testing overhead and accelerating account takeover campaigns dramatically.

Why This Matters: Account Takeover, Identity Theft, and Financial Fraud at Scale

With 41 million accounts exposed and passwords already in plaintext, the path from data leak to account takeover is shorter than with any other breach type. Attackers load this data into credential stuffing tools and begin accessing email accounts, streaming services, banking platforms, and corporate VPNs automatically. A compromised email account often leads directly to identity theft: attackers use password reset links to take over additional accounts, read private correspondence, and gather personal information for fraudulent applications. For accounts tied to financial services, unauthorized transactions follow quickly. The scale of this dataset, 301 million records, means the consequences extend to people who have never heard of TXTLOG_ALIEN and may have no idea their credentials are in circulation.

How the TXTLOG_ALIEN Collection Was Assembled and Distributed

ULP collections of this size are built by aggregating thousands of individual infostealer malware logs. Infostealer malware silently runs on infected computers, copies every saved browser password it can find, and sends that data to the attacker's server. The txtlog_alien actor compiled logs from many separate infections, structured the data into the standard URL:Login:Password format, and posted the combined collection to BreachForums where it was freely downloaded by the forum's membership. Collections reaching 301 million lines represent months of accumulated infections across many countries and device types. The plaintext nature of the passwords confirms these were captured directly from browsers rather than extracted from a hashed database, which is why no cracking step is needed.

Check If Your Email Is in This 301 Million Record Leak

With 41 million unique email addresses in this single collection, the TXTLOG_ALIEN 301M ULP dataset is one of the largest credential leaks of 2025. HEROIC's free breach scanner searches across more than 400 billion exposed records, including this collection, and will tell you immediately whether your email address appears and which accounts are at risk. Visit HEROIC.com, run a free scan, and find out before an attacker does. Changing one compromised password today can prevent a chain of account takeovers that are far harder to recover from later.