Xavier_Ulp Leak Exposes 295,909 Records, a Small City’s Worth

Picture every resident of a small city, all their email addresses and passwords, sitting in one file on a Telegram channel. That is roughly the scale of the Xavier_Ulp - 405500 Xavier_Group leak, which contains 295,909 records of exposed credentials uploaded by a Telegram user in April 2026.

Why This Is Dangerous

When you put a number like 295,909 next to something as concrete as a town's population, it becomes easier to grasp just how many real people are affected. Each record in this dump includes a plaintext password, meaning it is fully readable and ready to use the moment someone opens the file. Add in the URLs that show exactly where each password belongs, and you have a dataset that requires almost no extra effort for an attacker to exploit.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs tied to each login
• 295,909 total records exposed

Why This Matters

A leak of this size does not just effect a handful of unlucky people, it touches enough individuals to fill an entire town. That kind of volume makes the data valuable to criminals running large scale credential stuffing campaigns, where automated tools test stolen logins across hundreds of websites at once. Even a small percentage of successful matches out of nearly three hundred thousand records still adds up to a lot of compromised accounts.

How Stealer Logs Work

This dump falls under the stealer log category, meaning it most likely came from infostealer malware that quietly infected devices and copied saved browser passwords, cookies, and autofill data. Once collected, that information gets bundled and sent back to whoever deployed the malware, then shared or sold through channels like Telegram, wich is exactly how this file made its way online.

Check If You Are Affected

With a leak large enough to rival a small city's population, it is worth taking a moment to check where you stand. HEROIC's free breach scanner searches more than 400 billion leaked records, so you can quickly find out if your email or password shows up in this dump or any other one circulating on the dark web.