The 15K VPN Sites Leak Could Unlock More Than Your VPN Login

HEROIC analysts traced a combolist back to February 2023, uploaded to Telegram under the name "15k vpn sites HQ Combolist." The file contains 15,322 records, each pairing an email address with a plaintext password and the URL of a VPN service login page.

Why the 15K VPN Sites Leak Is Dangerous

VPN accounts are often used to protect other online activity, which means a compromised VPN login can expose far more than just the VPN service itself. If the same email and password combination was reused for banking, email, or work accounts, an attacker who gets into the VPN account has a strong lead on where else to try it.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of VPN service login pages

Why This Matters

People who use VPNs are often more privacy-conscious than average, which can make a leak like this one particularly damaging if it undermines the very protection they were relying on. With 15,322 plaintext credentials exposed, attackers have a ready-made list to attempt credential stuffing against the VPN providers themselves and any other accounts sharing the same password.

How This "HQ" Combolist Was Built

The "HQ" in this file's name is shorthand for "high quality," meaning the uploader claims the credentials have been checked or filtered for accuracy rather than being a raw, unverified dump. Combolists like this are usually assembled by harvesting logins from phishing pages built to mimic VPN sign-in screens, then bundling the confirmed working pairs together before sharing them on Telegram.

Check If You Are Affected

If you use a VPN service, it's worth checking whether your login is part of this leak. HEROIC's free breach scanner compares your email against more than 400 billion leaked records, including this combolist, so you can change your password before it's used to test your other accounts.