The 100k Gaming Combo Leak: 99,845 Passwords. Yours Could Be One.

HEROIC analysts identified a combolist called "100k Gaming Combo" that was compiled around April 2023 and has since been shared by a Telegram user. The file contains 99,845 records pairing email addresses with plaintext passwords and the URLs each login was tied to, with the labeling suggesting a focus on gaming accounts. Why this is dangerous: because the passwords are stored in plaintext, anyone who obtains this file can attempt to log in immediately, with no cracking or decryption needed. With nearly 100,000 records included, this is one of the larger combolists HEROIC has reviewed recently, giving attackers a large pool of accounts to try at once. What was exposed: email addresses, plaintext passwords, and associated URLs indicating where each credential was originally used. Why this matters: gaming accounts often have linked payment methods, saved purchase history, and connections to other platforms. If any of these 99,845 people reused their password elsewhere, attackers can use the same credentials to break into email, banking, or other gaming and social accounts through credential stuffing, which can lead to financial fraud or identity theft. How combolists like this one work: a combolist bundles usernames or email addresses with passwords, typically gathered from earlier breaches, malware infections, or manual scraping, then labeled by theme, such as gaming, and shared or sold on Telegram channels and dark web forums. Because the credentials are already organized and ready to use, combolists let attackers automate large-scale login attempts across many platforms at once. Check if you are affected: with almost 100,000 records in this file, there is a meaningful chance your information is included, especially if you play online games or reuse passwords. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records so you can quickly find out and take action if needed.