304,583 Passwords From the Xavier_Group ULP Dump Just Surfaced Online

On December 10, 2025, a Telegram user from the Xavier_Group channel uploaded a ULP stealer log containing 304,583 records to a dark web distribution network. The dataset exposes email addresses, plaintext passwords, and site URLs. HEROIC's breach team identified this log as part of ongoing monitoring efforts. The data has definatly been in criminal hands for months, increasing the risk that any affected accounts have already been accessed or resold.

Why the Xavier_Group Breach Is Dangerous

The Xavier_Group ULP dump provides attackers with a URL, a login email, and a plaintext password for each of the 304,583 records. With all three fields included, there is no preparation required: criminals can attempt to log in directly to each site listed without cracking any passwords or guessing account details. The six-month window since the original leak date means some victims may have experienced unauthorized account access without realizing the source.

What Was Exposed in the Xavier_Group Leak

• Email Addresses
• Plaintext Passwords
• URLs

Why This Xavier_Group Data Puts You at Risk

Data that has been circulating in criminal networks for months is more widely distributed than a recent leak. Each time a credential dataset is shared or resold, more actors gain acces to it. If your email and password appeared in the Xavier_Group ULP dump, you may have already been targeted. Changing passwords on any service where you reuse credentials is critical, even if you have not noticed any suspicious activity yet.

How Stealer Logs Work

Stealer malware extracts browser-stored credentials from infected devices and transmits them to operator-controlled servers. Groups like Xavier_Group organize these logs into ULP format and publish them on Telegram for followers aquiring stolen data. The structured format makes the credential sets easy to use in automated account takeover attacks, where criminals run through thousands of login attempts per minute across multiple websites.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the Xavier_Group leak or thousands of other breaches in our database.