ULP Cloud Breach: 16M Plaintext Passwords Compromised

In October 2025, a catastrophic stealer malware breach exposed 16,099,184 user records from the Nullcyber Cloud ULP platform. This represents one of the largest single credential theft incidents ever recorded, with plaintext passwords, email addresses, and API infrastructure details publicly distributed on Telegram. The sheer magnitude signals an industrialized attack targeting the entire ULP ecosystem.

Why This Is Dangerous

A dataset of 16+ million credentials crosses the threshold from security incident into systemic infrastructure failure. The volume is large enough to compromise the integrity of password security across entire industries. Attackers can deploy 16 million plaintext password-email pairs into mass credential stuffing botnets, targeting financial institutions, government services, corporate networks, and email providers simultaneously. Every victim faces automated compromise attempts across their entire digital presence.

What Was Exposed

• 16,099,184 plaintext user passwords
• Email addresses and usernames for targeted attacks
• API keys and service tokens
• Internall infrastructure URLs and configuration data
• Session authentication tokens and cookies

Why This Matters

At 16 million records, this breach enables automated large-scale exploitation. Threat actors can weaponize this dataset into credential stuffing operations targeting banks, governments, and enterprises. The plaintext passwords are immediately actionable with zero computational cost. Underground markets now have a commodity supply of valid credentials for years. Attackers can establish backdoor access into 16 million accounts, install information-stealing malware, and maintain persistent presence for espionage or financial theft.

How Nation-Scale Stealer Campaigns Operate

Breaches of this magnitude suggest sophisticated, coordinated attack infrastructure. Stealer malware is distributed through supply-chain compromises, trojanized downloads, and mass phishing campaigns. The malware operates across infected endpoints for months, harvesting credentials, API keys, and sensitive files. Exfiltration infrastructure is designed to handle massive data volumes through decentralized channels. Distribution happens across dark web marketplaces, private forums, and public Telegram channels to maximize reach and monetization.

Check If You're Affected

If you had a Nullcyber Cloud ULP account in October 2025 or earlier, your credentials are comprehensively comprommized and already traded in underground markets globally. Change passwords immediately on that account and all others using the same or similar credentials. Enable two-factor authentification on every critical account. Monitor financial and email accounts for unauthorized access.