The Xavier_Ulp 303500 Dump: 211,307 Stolen Login Credentials

The Xavier_Ulp - 303500 Xavier_Group combolist surfaced on Telegram in August 2026: inside were 211,307 email and password pairs, every one of them stored as readable plain text. Scanning your email tells you in seconds whether your login is one of the 211,307.

A Familiar Name, a New Batch

This isn't the first Xavier_Ulp file HEROIC has tracked, and it likely won't be the last. Each batch under this name represents a fresh collection of credentials pulled together and shared separately, even when it reuses a recognizable label.

What Was Exposed

• Email Addresses: identifies the account holder and gives attackers a target for phishing.
• Plaintext Password: already readable, meaning it's ready to use without any cracking step.
• URLs: shows which specific site or service each credential pair was collected against.

Why Repeated Batches Are Still Worth Checking

Just because a name like Xavier_Ulp keeps reappearing doesn't mean the risk fades. Each new batch can include different accounts than the last, so being clear on a previous file doesn't guarantee you're clear on this one.

How a Batch Like This Gets Assembled

Files under the Xavier_Ulp label are compiled from credentials gathered across various leaks and stealer infections, packaged together, and distributed under a consistent naming pattern that makes them easy to track over time.

Check This Specific Xavier_Ulp Batch for Your Email

Scan your email to see if you're part of the 211,307. If you are, change that password now, on both personal and work accounts, since a plaintext credential works the same on either.