10 MILLION CORP Dump Puts 8,567,268 Passwords Online Now

HEROIC analysts found the 10 MILLION CORP combolist, dated 12-Jan-2026, pairing 8,567,268 email addresses directly with plaintext passwords and the website URLs each login unlocks. The only way to know if you're affected is to scan your email.

Why a Pre-Matched Password List Is So Dangerous

Because every password in this file sits right next to the exact site it opens, there is no guesswork involved, whoever has this list can try each login directly against the matching account.

What Was Exposed

• Email Addresses: identifies the account and enables targeted phishing.
• Plaintext Password: stored in readable text, so it can be used immediately without cracking.
• URLs: points an attacker straight to the exact account each password unlocks.

Why Scale Makes This More Urgent

At this scale, automated tools can work through millions of email, password, and URL combinations in minutes, attempting logins across banking, shopping, email, and social accounts wherever the credentials still work. Any account using one of these exact passwords is exposed the moment this file circulates.

How a Combolist This Size Gets Compiled

A combolist like this one is built by collecting email and password pairs from many earlier leaks and infections, then testing and bundling the ones that still work into a single file. It is not the result of one company being hacked, it is a compiled list assembled for reuse attacks across many sites at once.

Were Your Logins Bundled Into the 10 MILLION CORP File?

Scan your email to check against this and other known leaks.

If your email turns up, change that password everywhere you have reused it, and give each account its own unique password going forward.

This applies to personal and work email alike.