UP_KURZL0G 131: 2,209,730 Passwords Leaked in Plain Text

Just one entry away from "UP_KURZL0G 130," a second file called "ULP New Fresh Database Nov 5 - UP_KURZL0G 131" landed on the same Telegram channel on November 5, 2025, this time holding 2,209,730 sets of credentials, over half a million more than its companion file. Same day, same uploader, and yet an even bigger haul of exposed emails, passwords, and URLs.

Why This Is Dangerous

Two related dumps hitting the same day isn't a coincidence, it usually means the source, likely a large batch of infected devices, was still producing fresh data when the first file was posted. Every one of the 2,209,730 records here contains a plaintext password, so there's definately nothing standing between an attacker and a working login except the effort of opening the file.

What Was Exposed

• Email addresses for over 2.2 million accounts
• Plaintext passwords stored with no protection
• URLs showing where each login was captured

Why This Matters

When two files this large surface from the same source on the same day, it usually points to an ongoing malware operation rather than a one time leak. It would be a mistake to asume the smaller file is any less dangerous than the larger one. That means more victims are likely still being added even after this file was uploaded, and protecting the people whose data is here is neccessary right now, since many may not even know their device was compromised in the first place.

How Stealer Logs Work

The "UP_KURZL0G" naming pattern suggests these two files came from the same stealer malware operator, harvesting login data from infected computers and organizing it into batches before release. Malware like this quietly reads saved browser passwords and autofill fields, then exports everything into the kind of URL, login, password format seen in both the 130 and 131 files.

Check If You Are Affected

Between the two related files, more than 3.8 million credential sets were dumped in a single day. HEROIC's free scanner checks your email against over 400 billion (400B+) leaked records, so you can quickly relize whether you're part of either file and take steps to secure your accounts before someone tries to log in ahead of you.