15k Shopping Sites HQ Combolist Could Expose Bank and Email Logins

The 15k Shopping Sites HQ Combolist: What HEROIC Analysts Found. HEROIC analysts identified a combolist labeled 15k Shopping Sites HQ, uploaded by a Telegram user and tied to a leak dated December 28, 2022. The file contains 15,215 records pairing email addresses with plaintext passwords, along with the URLs of the shopping sites those credentials unlock. Why This Is Dangerous. This combolist is built specifically around shopping site logins, meaning the accounts inside it are tied to real online stores where saved payment methods, order histories, and personal details often live. A working email and password pair for a shopping account can let an attacker place orders, view stored addresses, or access saved payment information. What Was Exposed: Email addresses tied to individual shopping accounts. Plaintext passwords with no encryption. The URLs of the shopping sites those credentials belonged to. Why This Matters. Because the passwords in this file were reused across multiple shopping sites by design, anyone whose information appears here is at risk of credential stuffing far beyond the original accounts. If the same password was used for email or banking, those accounts are exposed to takeover as well. How Combolists Work. A combolist compiles working, or once-working, login pairs from stealer malware, previous breaches, or phishing campaigns into one large file. This particular list appears to focus on shopping site logins, likely assembled by testing stolen credentials against thousands of online stores and keeping the pairs that worked. These lists are traded and shared on platforms like Telegram, where other criminals pick them up for further attacks. Check If You're Affected. If you shop online and want to know whether your email address shows up in this leak or another one, HEROIC's free breach scanner checks it against a database of more than 400 billion leaked records in seconds.