US Users Exposed as SunCloudNew ULP Leak Hits 594,722 Records

A fresh ULP dump going by the name SunCloudNew 1749 - 857 K ULP surfaced on Telegram on June 6, 2026, and inside it sat 594,722 records tied largely to accounts based in the United States. ULP stands for URL, login, password, and that is exactly the recipe packed into this file.

Why This Is Dangerous

A file this size is not something one person put together by hand. It is the kind of collection that gets fed into automated tools within hours of hitting a Telegram channel, tools that attempt to log into hundreds of thousands of accounts accross banking sites, email providers and shopping platforms all at once. The sheer scale means even a small success rate translates into thousands of compromised accounts.

What Was Exposed

• 594,722 individual records
• Email Addresses
• Plaintext Passwords
• URLs for the impacted accounts

Why This Matters

Because the passwords in this dump are stored in plaintext, there is no scrambling or hashing to slow anyone down. Criminals can copy and paste credentials directly into login forms, wich is why ULP dumps like this one are so popular on underground markets. If your email shows up here and you have not changed your password since, it is definately worth doing so today rather than waiting.

How a ULP Leak Like This Comes Together

ULP style dumps are usually assembled from multiple smaller stealer infections, then merged, cleaned up and relabeled before being resold or shared for free to build a seller's reputation. The name SunCloudNew likely refers to the seller or the batch itself rather than a single hacked company, since the underlying data was probably harvested from many separate infected devices over time.

Check If You Are Affected

Wondering if your login information ended up in this SunCloudNew batch or another one like it? HEROIC offers a free breach scanner that checks your email against over 400 billion compromised records collected from stealer logs, ULP dumps and combolists just like this one.