Xavier_Ulp Breach: 207,602 Plaintext Passwords Leaked Online

HEROIC analysts identified a stealer log file uploaded to a Telegram channel in February 2026, tied to a batch tracked as Xavier_Ulp. The file conatins 207,602 individual records, each pairing a login URL with an email address and a plaintext password. This is not a hacked database from a single company. It is raw output from malware that sat quietly on infected devices, copying down whatever the victim typed into their browser.

Why This Is Dangerous

Every one of these 207,602 entries is a ready-to-use login. There is no password to crack and no hash to decode. An attacker can simply open the file, copy a URL and its matching email and password, and log straight into that account. Because stealer logs capture credentials exactly as the victim entered them, they tend to work immediately, often before the victim even realizes their device was infected.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs (the exact sites each credential unlocks)

Why This Matters

A record this specific, email, password, and the exact site it opens, is a shortcut for criminals. It skips the guesswork entirely and enables instant account takeover. Because most people reuse passwords across multiple accounts, a single stolen credential can unlock email, banking, and shopping accounts alike. This is the foundation of credential stuffing attacks, and it often leads straight into identity theft or financial fraud once an attacker is inside.

How Stealer Logs Work

Stealer logs come from infostealer malware, a type of infection that hides on a victim's computer and quietly harvests saved passwords, browser autofill data, and even session cookies. Unlike a traditional data breach, where a company's server is broken into, a stealer log is built one infected device at a time. Criminals then package these logs, sometimes containing thousands of individual victims, and sell or share them in bulk on Telegram channels and dark web forums, exactly as seen with this Xavier_Ulp upload.

Check If You Are Affected

You do not need to guess whether your information showed up in a log like this one. HEROIC's free breach scanner checks your email against a database of more then 400 billion leaked records, including stealer log dumps like this. Run a free scan today to see if your credentials need to be changed.