The Xavier_Ulp Combolist Surfaced Days Ago: 209,000 Accounts Exposed

In late July 2026, HEROIC analysts identified a combolist circulating in Telegram channels labeled "Xavier_Ulp - 427000 Xavier_Group," exposing 209,107 records tied to United States accounts. The file, dated 29-Jul-2026, was uploaded by a Telegram user and bundles email addresses, plaintext passwords, and the URLs of the sites those credentials were used on.

Why This Is Dangerous

Because the passwords in this file are stored in plaintext, anyone who downloads it can immediately try each email and password pair on other websites without cracking or decrypting anything. Paired with the URLs included in the dump, which show which site each credential was originally tied to, attackers get a ready-made target list for logging into email, banking, and shopping accounts.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs linking each credential pair to its original site

Why This Matters

Combolists like this one fuel credential stuffing attacks, where automated tools test stolen email and password pairs against hundreds of other websites at once. If you reused a password anywhere covered by this leak, an attacker could access your accounts without ever guessing your credentials, opening the door to account takeover, financial fraud, and identity theft.

How Combolist Leaks Work

A combolist is rarely the result of one company getting hacked. It is usually a compiled batch of email and password pairs pulled from older leaks, stealer logs, or phishing campaigns, then repackaged and redistributed on Telegram and dark web channels. The Xavier_Group file follows this pattern: a large batch of live credentials assembled and shared for other cybercriminals to use in automated login attempts.

Check If You Are Affected

With 209,107 records now circulating just days after this file surfaced, the window to act is short. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including combolists like this one, so you can find out quickly if you were exposed and change any reused passwords before someone else logs in first.