The ‘1k USA Combo’ Quietly Surfaced With 479 Stolen Logins

In October 2024, a small combolist named "1k USA COMBO" quietly appeared on Telegram, uploaded by a user with no fanfare or announcement. HEROIC analysts confirmed 479 exposed records made up of email addresses, plaintext passwords, and the URLs each login was used on.

Why a Quiet Leak Is Still a Real One

Not every stolen data file makes headlines or spreads through major channels right away. Small, quietly circulated combolists like this one can sit in narrower Telegram groups for a while before anyone outside notices, giving the people responsible time to test the logins or sell access before the leak draws attention. The lack of noise does not mean the data is any less real or any less dangerous to the people in it.

What Was Exposed

• Email addresses tied to U.S. accounts
• Plaintext passwords, stored with no encryption
• URLs identifying the exact site each credential belongs to

Why This Matters

Each of the 479 records in this file is a complete, working login, ready to be tested against other accounts. For the people affected, that means real exposure to credential stuffing, account takeover, and identity theft if the exposed password protects an email, banking, or shopping account elsewhere.

How Small Combolists Like This One Circulate

Combolists start as raw stealer log output, malware-collected credentials from infected devices. Someone compiles a batch focused on U.S. accounts, cleans it up into a simple list, and shares it in smaller Telegram groups, sometimes for free to build reputation, sometimes for a small price. Files this size often move quietly for weeks before wider distribution, which is exactly why they are easy to miss.

Check If You Are Affected

A quiet leak can still expose your password. HEROIC's free breach scanner checks your email address against a database of more than 400 billion breached and leaked records, so you can confirm your exposure in seconds and change any reused passwords right away.