Xavier_Ulp Leak: 280,039 Logins Exposed in Plaintext, Check Now

HEROIC analysts verified a stealer log file labeled Xavier_Ulp, tied to the Xavier_Group tag, uploaded to Telegram on 9 July 2026. The uploader advertised 344,390 records, but HEROIC's verification confirmed 280,039 actual records containing email addresses, plaintext passwords, and login URLs, a meaningful gap between the marketed size and the real, usable data inside the file.

Why the Xavier_Ulp Leak Is Dangerous Right Now

This leak surfaced within the past month, meaning the credentials inside are far more likely to still be active than data from an older breach. Every password is stored in plaintext, so no cracking is required, and each entry is paired with the exact URL it was captured from. For anyone in this dataset, the window to change a reused password before it gets tested elsewhere is closing fast.

What Was Exposed in Xavier_Ulp

• Email addresses
• Plaintext passwords
• URLs of the sites where credentials were entered

Why This Matters for Anyone in the Xavier_Group Data

Fresh plaintext credentials like these are exactly what attackers need for credential stuffing, automatically testing the same email and password against banking, retail, and email platforms before victims have a chance to react. Because this leak is recent, the risk of account takeover, identity theft, and financial fraud is higher right now than it would be for an older, already-picked-over dataset.

How a Xavier_Ulp-Style Stealer Log Gets Made

Files like this are produced by infostealer malware that infects a device and silently copies every saved browser password along with the site it belongs to. The stolen data is compiled into a ULP-format file, tagged here as Xavier_Ulp under the Xavier_Group label, and uploaded to Telegram, sometimes with an inflated record count to make the listing look bigger than the verified data actually supports.

Check If You Are Affected

With a recent leak like this one, checking your exposure now matters more than usual. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can find out immediately and change any passwords still at risk.