10K USA Mail Combo Leak: Search Your Email, 9,704 Exposed

In May 2026, HEROIC analysts identified a large file circulating on Telegram called "10k Combo USA Mails Access," containing 9,704 records of United States email account credentials. The file included email addresses, plaintext passwords, and the URLs of the login pages those credentials were entered on, compiled specifically as a bundle of American email logins rather than a general, unsorted stealer log.

Why This Is Dangerous

Grouping thousands of credentials by country makes a file like this more useful to criminals running region-specific scams, phishing campaigns, or fraud schemes that rely on knowing a victim's likely location. With 9,704 email and password pairs stored in plaintext and matched to the exact site each one unlocks, an attacker does not need to crack anything or guess where to try a login, the file hands over a ready-made target list.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

Email accounts are frequently the gateway to a person's wider digital life, tied to banking alerts, online shopping, and password resets for dozens of other services. With nearly 10,000 records in this single file, the risk of account takeover extends to a large number of individuals at once, and anyone who reused their email password on another site faces an additional risk of credential stuffing, where attackers try the same login across multiple platforms hoping it still works.

How Stealer Logs Work

Stealer logs are generated by malware that quietly infects a device, often through pirated software, fake updates, or malicious email attachments, then harvests saved browser passwords, autofill data, and active login sessions. Criminals frequently sort these raw logs by country or email provider, as this file appears to have been, before packaging and selling them through Telegram channels and dark web marketplaces. Because the credentials come directly from the victim's own browser, they tend to be current and accurate, which is exactly what makes a large, organized file like this valuable to buyers.

Check If You Are Affected

If you have a US-based email account, it is worth taking a moment to search your address and find out whether it appears in this leak. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, so you can see your exposure and secure your account before someone else does.