The 25k Food Sites Base Dump Put 24,777 Restaurant Logins at Risk

HEROIC analysts identified a combolist called "25k Food Sites Base" uploaded to Telegram on February 7, 2023. The file contains 24,777 records made up of email addresses, plaintext passwords, and the URLs of the food-related websites those logins belong to, all packaged into a single file ready for anyone to use.

Why This Is Dangerous

What makes this file useful to criminals is not just the volume, it is the focus. Every record links a working plaintext password to the exact food-industry site it was collected from, giving an attacker a ready-made target list instead of a random pile of credentials. They can pull a login straight from the file and try it on the matching site immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the food-related sites tied to each login

Why This Matters

Combolists built around a single type of website are often used to test credential stuffing on a focused scale before branching out further. If you reused this password on other accounts, especially email, banking, or social media, one exposed login here can quickly lead to account takeover, financial fraud, or identity theft.

How This Combolist Was Assembled

Combolists like this are typically built from older breaches, stealer log outputs, or previously exposed databases, then sorted and reformatted into email:password pairs tied to a specific category of website, in this case food-related sites. Once assembled, they are shared freely or sold on Telegram channels, which is where HEROIC analysts located this file.

Check If You Are Affected

If you have used a food ordering or delivery site and reused the same password elsewhere, it is worth checking your exposure now. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to show you whether your email and password appear in this combolist or any other exposure, so you can update your credentials before someone else uses them.