100K HQ JAPAN COMBOLIST GOOD FOR ANYTHING Leaks 89,499 Logins

HEROIC analysts found a combolist called 100K HQ JAPAN COMBOLIST GOOD FOR ANYTHING circulating since January 15, 2026, holding 89,499 sets of email addresses, plaintext passwords, and linked URLs. Every password in the file is stored as plain, readable text, so whoever has it can log in with the credentials right now. Because the list is already being traded, scan your email is the only way to know if you're in it.

Why Plaintext Credentials From This Japan Combolist Spread Fast

A combolist like this pairs working email addresses with passwords stored in plain text, so there is no encryption or hashing standing between the data and an attacker's keyboard. Anyone who grabs the file can plug the credentials straight into other login forms without cracking a single character. That removes the biggest obstacle that normally slows credential thieves down.

Because the file is labeled "good for anything," whoever uploaded it is openly advertising it as useful against a wide range of sites, not just one. That makes it attractive to criminals running large-scale automated login attempts.

What's Packed Into the 89,499 Leaked Records

• Email Addresses: let an attacker identify a real account and target it directly with phishing or takeover attempts.
• Plaintext Password: readable the instant it's downloaded, so it can be used to log in without any cracking required.
• URLs: tell the attacker exactly which site or service each email and password pair belongs to, so they know where to try it first.

The Real-World Fallout for the 100K HQ Japan List

Because so many people reuse the same password across multiple accounts, a working email and password pair can unlock far more than the original login. An attacker can take over the linked account, lock the real owner out, and pivot to resetting passwords on any other service tied to that same email address.

If any of the linked URLs point to a shopping, banking, or financial service, the same credentials can be used to commit fraud or drain stored payment methods before the owner even notices.

How a Combolist Like This One Gets Built

A combolist is assembled by pulling email and password pairs from many earlier leaks and login attempts, then bundling them into a single file so criminals can test which ones still work. It isn't pulled from one company's servers; it exists purely to see where reused logins still open the door. Files like this one get passed around Telegram channels precisely because reused passwords make them valuable.

Still Using the Same Password Somewhere Else?

The fastest way to find out if your details are inside this file is to scan your email. If you get a match, change the password everywhere you've reused it, starting with your email account and any service tied to the listed URLs. This applies whether the address you check is a personal inbox or a work one, since both show up in combolists like this.