21,069 Plaintext Passwords Dumped in the GMX Combo Leak

HEROIC discovered a credential dump labeled GMX Combo, shared on Telegram in February 2025, containing 21,069 compromised records. The collection specifically targets GMX email users, with credentials harvested by infostealer malware from infected devices. Each record includes a working email-and-password pair along with the website where the login was captured.

Plaintext Passwords Leave Accounts Wide Open

Every password in the GMX Combo dump is stored in plaintext — fully readable, with no encryption or hashing applied. An attacker with access to this file can log into any of the 21,069 accounts immediately, without needing specialized tools or technical knowledge. For GMX email accounts specifically, this means direct access to inboxes, contacts, and any services linked to that email address.

What Was Exposed

• Email Addresses — primarily GMX email accounts, serving as both login usernames and contact identifiers
• Plaintext Passwords — fully unencrypted credentials captured directly from victims' devices
• URLs — the specific websites and login portals where credentials were intercepted

Why Email Account Breaches Are Especially Dangerous

When an attacker gains access to your email account, they gain the ability to reset passwords on virtually every other service you use. Credential stuffing attacks using email-and-password pairs from this GMX Combo leak can quickly spiral into full identity compromise. Attackers test these credentials across banking portals, e-commerce sites, and cloud platforms, knowing that password reuse gives them high success rates.

How Infostealer Malware Harvested This Data

The credentials in GMX Combo were collected by infostealer malware — software that installs itself through trojanized downloads, phishing attachments, or drive-by exploits. Once on a device, the malware extracts saved passwords from browsers, logs keystrokes during login sessions, and captures authentication cookies. The stolen data is structured into log files organized by service, then uploaded to Telegram channels where collections like GMX Combo are distributed to other threat actors.

Check If Your Credentials Were Exposed

HEROIC has fully indexed the GMX Combo leak in its data breach scanner. With over 400 billion records in the database, HEROIC can instantly confirm whether your email or password appears in this dump or any other known breach. Search now, update compromised passwords without delay, and enable two-factor authentication on your email and all connected accounts.