Your Email Could Be Inside REAPER’s 108,077-Record ULP Leak

Is your email sitting inside a file called REAPER right now? In March 2026 a Telegram user uploaded this ULP dump, short for "user, login, password," and it contained 108,077 records of real email addresses, plaintext passwords, and the exact URLs they were used on.

Why This Is Dangerous

A ULP file like REAPER is basically a shopping list for criminals. Each line pairs an email with a password and a website, wich means an attacker doesn't have to guess anything, they just try the exact combination that's already sitting in front of them. With 108,077 lines to work through, even a low success rate still hands over a large number of working accounts.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs matched to each login
• 108,077 records total

Why This Matters

If your email happens to be one of the 108,077 in this file, the damage doesn't stop at whatever site the password was originally used on. People resuse passwords constantly, so a login stolen from one small site can definately unlock your email, your bank, or your work account too. That's the real risk here, not just one account but everything connected to it.

How Stealer Logs Work

Files like REAPER are the end result of stealer malware, a type of infection that quietly sits on a victim's computer and records saved browser credentials. Once collected, the data gets bundled into a ULP format and released, often for free at first, to attract buyers who will pay for bigger or fresher batches later. It's a business model, and dumps like this one are basically free advertising for it.

Check If You Are Affected

You can find out directly instead of wondering. HEROIC offers a free breach scanner that checks your email against more than 400 billion exposed records, including ULP dumps like REAPER, so you know exactly where you stand and what to change.