Analysts Traced File 14113 to 14,104 Exposed Login Passwords

HEROIC analysts traced a messy, unlabeled file down to a working combolist: 14113, dated October 21, 2020 and added to HEROIC's records on September 22, 2026, contains 14,104 email and plaintext password pairs, each tied to a login URL. A free scan your email checks whether your password is one of the 14,104 exposed.

Why This Is Dangerous

Despite its unclear origin, every record in 14113 functions the same as a cleanly branded leak: a working password matched to the exact page it unlocks. An attacker gains nothing less from a messy file name than from a polished one.

What Was Exposed

• Email addresses: the identifier attackers pair with each stolen password.
• Plaintext passwords: readable and immediately usable, no cracking required.
• URLs: the specific login page tied to each credential pair.

Why This Matters

A 2020 date means these passwords have had years to spread to other accounts through reuse. Anyone who never changed the password captured here is still exposed today, on this account and any other where the same password was used. The messy raw label attached to this file is a sign it was likely batch processed alongside many similar dumps, not a one-off, hand curated leak.

How A File Like This Gets Assembled

Analysts often see raw file names like 14113 attached to combolists split off from larger, older leaks rather than freshly branded breaches. The data still gets used the same way, run through credential stuffing tools that test each pair against many login pages at once. A messy label is usually a sign of bulk processing, not a smaller or less serious file.

See If 14113 Includes Your Login

A free scan your email checks your address against file 14113 and HEROIC's full breach index at once. If you're listed, change that password now, stop reusing it elsewhere, and enable multi-factor authentication wherever possible, for personal and work email alike.