Researchers Link the 100k usa Dump to 99,979 Stolen US Credentials

HEROIC analysts have identified a combolist file called “100k usa uploaded by a Telegram User,” which surfaced on Telegram on February 28, 2023. The file contains 99,979 records tied primarily to accounts in the United States, pairing email addresses and usernames with plaintext passwords and the URLs those credentials unlock.

Why This Is Dangerous

Nearly 100,000 email and password pairs sit in this single file, each one matched to the exact site it logs into. Because the passwords were stored in plaintext, there is no encryption for an attacker to break through, meaning the credentials can be used the moment someone downloads the file.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each set of credentials

Why This Matters

A file of nearly 100,000 credential pairs gives attackers plenty of material for credential stuffing, automatically testing stolen email and password combinations against banking sites, email providers, and social media platforms. Anyone in this file who reused their password elsewhere is exposed to account takeover, and a compromised email account often becomes the key to resetting passwords on other services, which can lead to identity theft and financial fraud.

How Combolists Work

A combolist is a compiled file of email or username and password pairs, typically gathered from earlier breaches and stealer logs and organized into one large list. Criminals build and trade combolists like this one because they can be loaded directly into automated tools that test each pair against many websites at once. The 100k usa file follows this pattern, bundling 99,979 credential pairs together with the URLs needed to use them right away.

Check If You Are Affected

To find out if your email address is part of this leak or any other breach, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. Run a scan now and update any passwords you have reused across multiple accounts.