US Users Targeted: 16.3KK Combolist Hits 14.6M Accounts

The name is almost comically blunt: "16.3KK BIG USA MIX BASE," using the leetspeak shorthand "KK" some sellers use for millions, attached to a file that actually holds 14,692,661 records. Dated February 3, 2026, this is a combolist, a different animal from a typical stealer log, and its scale puts it in a category most individual leaks never reach.

Why This Is Dangerous

Almost 14.7 million email and password pairs is enough to run large-scale automated attacks against nearly every major website at once. A file this size isn't circulated for curiosity, it's built specifically to be fed into credential-stuffing tools that can test millions of logins in a matter of hours.

What Was Exposed

• Email or username and password combinations, the defining feature of a combolist
• Plaintext passwords with no encryption protecting them
• URLs tying credentials to specific accounts and services

Why This Matters

Combolists like this one are built by combining data from many older leaks into a single, easy-to-use file. That means even if the individual breaches behind it are old news, the combined list is a fresh and powerful tool for attackers, especially against anyone who has been reusing the same password for years.

How a Combolist Differs From a Stealer Log

Unlike a stealer log, which comes from malware harvesting data off individual infected machines, a combolist is typically assembled by pulling matching email and password pairs out of many separate previous breaches and merging them together. Sellers sort and clean the data, remove duplicates, and package it as a single "base," like this USA-focused mix, so buyers can run it against fresh targets without digging through dozens of older leaks themselves.

Check If You Are Affected

With a file this large, the odds that one of your old passwords still has an existance somewhere in this list are higher than you might think, so I'd reccomend checking rather than hoping for the best. HEROIC's free scanner searches more than 400 billion (400B+) leaked and breached records, including massive combolists like this 14.6 million entry USA base, and shows you results in seconds.