How the “ulp_5_09” Breach Leaked 13,226 Login Credentials

In September 2025, HEROIC analysts traced a stealer log named "ulp_5_09" back to a Telegram channel, where it had been uploaded by an anonymous user. The file holds 13,226 records of email addresses, plaintext passwords, and the website URLs each login is tied to.

How This Leak Actually Happened

This did not start with a hacker breaking into a company's servers. It started with malware quietly landing on individual computers, likely through a pirated program, a fake software crack, or a malicous email attachment. Once running, the malware scanned each browser for saved logins and copied everything it found.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated website URLs

Why This Matters

Because the stolen data pairs a working password directly with the login page it opens, attackers can skip straight to account access. Left unchecked, this leads to credential stuffing on other sites, account takeover, and eventually identity theft or financial fraud.

How Stealer Logs Work

After infecting a device, the malware compiles a "log," a single file listing every saved password, autofill entry, and cookie it collected. That log gets uploaded to marketplaces or shared for free on Telegram channels, exactly the path this 13,226-record file took before HEROIC identified it.

Check If You Are Affected

Wondering if you were part of this or a similar leak? HEROIC's free breach scanner checks your email against more than 400 billion exposed records, giving you a clear answer in seconds.