A Second Winery ULP File Confirms 1.3 Million More Logins

Tracking the same Telegram channel that posted an earlier Winery ULP file, HEROIC analysts found a second, larger one: Winery ULP 3.600.000 LINES, uploaded in August 2026. Of the 3.6 million raw lines in the file, 1,347,943 checked out as confirmed, working email and password pairs, every one stored in plain text. Scan your email to see if your account is among them.

Why Finding a Second File Matters

When the same source keeps producing large batches of confirmed credentials, it signals an ongoing operation rather than a one time event, which makes checking your own exposure worth doing every time a new file surfaces. A recurring pattern like this also means the earlier file's records shouldn't be treated as old news, since the same operator is clearly still active.

What Was Exposed

• Email addresses: identify the account tied to each confirmed record.
• Plaintext passwords: readable and usable immediately, with no cracking needed.
• URLs: show the exact login page each credential unlocks.

What a Discovery This Size Enables

With over 1.3 million confirmed logins in one file, automated tools can work through the entire batch quickly, testing each password against other popular sites in search of reuse.

How a Second Winery ULP File Gets Produced

Whoever runs this operation appears to repeat the same process: gather large batches of stolen credentials, verify which ones still work, and release the confirmed set as a new file under the same naming pattern.

Check This Newly Found File

Scan your email to check. If you're among the confirmed accounts, change that password now and anywhere else you reused it, from a device you trust. This applies to personal and work email accounts equally.