Your Inbox May Be Inside the 111M Unique Gmails Combolist

A combolist titled 111M Unique Gmails surfaced on Telegram on August 23, 2026, pairing 110,512,352 Gmail addresses with plaintext passwords and the web addresses those logins were used on. Each row links one inbox straight to a working password, which is what makes a combolist like this so immediately usable. The only way to know if your address is paired with a password in this file is to scan your email.

Why a Gmail-Only List Still Appeals to Attackers

Gmail addresses are used to log into far more than just an inbox, since so many other services rely on that same address for sign in or password recovery. A combolist built entirely around Gmail addresses gives attackers a ready list of identities to test across banking, shopping, and social accounts, not only against the email account itself.

What Was Exposed

• Email Addresses: confirms the exact Gmail account tied to each password in the list.
• Plaintext Password: already readable, so no cracking step stands between discovery and a login attempt.
• URLs: shows which site a given password pairing was actually used on, beyond the inbox itself.

Why This Matters

At this scale, the risk is less about any one targeted attack and more about automation. Tools built for credential stuffing can run all 110 million pairs against popular login pages in bulk, and any match becomes an open account, especially where the same password was reused on the Gmail login itself.

How This Breach Type Works

A combolist is not a single company's data getting stolen. It is built by gathering email and password pairs from many separate leaks and stealer logs, then matching reused credentials together into one large file. That is why a list like this one can hold passwords that originated anywhere, simply sorted here by Gmail address.

Is Your Gmail Address Part of the 111M Unique Gmails List?

Start with the scan your email tool above to check your exposure directly. If a match turns up, change that password everywhere you have reused it, starting with the Gmail account itself and any service that relies on it for recovery. Treat a personal Gmail address with the same urgency as one you use for work, since both can unlock a long chain of other accounts.