The ULPJune-2026 Leak Has More Records Than Pennsylvania’s Population

13.4 Million Records Surface in the ULPJune-2026 Telegram Stealer Log

HEROIC analysts uncovered a large stealer log, referred to by its uploader as "18M Private ULPJune-2026," circulating in a Telegram channel. The file was dated 27 June 2026 and contains 13,410,910 individual records pairing email addresses with plaintext passwords and the URLs where those credentials were used, consistent with malware that harvests saved logins directly from infected devices.

Why This Is Dangerous

With more than 13 million plaintext email and password combinations in a single file, attackers don't need to crack or guess anything, they can simply try the credentials as-is. Logs of this size are frequently automated into large-scale credential stuffing attacks, where bots test stolen logins against banking, email, and shopping sites in bulk, hoping victims reused the same password elsewhere.

What Was Exposed in the ULPJune-2026 Dump

• Over 13.4 million email addresses
• Plaintext passwords paired with each email address
• URLs identifying the sites and services those credentials were used on

Why This Matters

The scale here is the problem. A leak this large gives attackers a ready-made list to run against major platforms, and because the passwords are already in plaintext, every failed attempt costs them almost nothing. Anyone whose credentials appear in this log faces a real risk of account takeover, especially if they've reused the same email and password combination on other sites.

How a Stealer Log This Size Gets Built

Infostealer malware infects individual devices one at a time, quietly copying saved browser passwords, autofill data, and session cookies before sending them to the attacker's server. A log of 13.4 million records like this one is typically assembled by combining output from many separate malware infections, or by merging several smaller logs into one large file before it's uploaded and sold or shared on Telegram.

Check If You Were Exposed in the ULPJune-2026 Leak

Given the size of this dump, checking your exposure is worth doing even if you don't recognize the file name. Run your email through HEROIC's free breach scanner, which checks against more than 400 billion leaked records, including stealer logs like this one, and update any passwords that come back as compromised.