If You Shop Online, the 271k Shopping Leak Should Worry You

In December 2022, HEROIC's threat intelligence analysts uncovered a combolist uploaded to Telegram by an anonymous user, tracked as "271k shopping uploaded by a Telegram User." The file contains 270,327 records, pairing email addresses with plaintext passwords and the URLs of the shopping and retail sites those credentials unlock.

Why This Is Dangerous

Shopping accounts are not just a wish list. Many of them have a saved credit card, a stored home address, and an order history attached. Because the passwords in this file are stored in plaintext, there's no cracking required, and the attached URLs tell an attacker exactly which retail site each login opens. That combination turns a simple list into 270,327 ready-made attempts at account takeover.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each credential pair

Why This Matters

If you reuse a password across shopping sites and other accounts, this leak puts more than your retail login at risk. Attackers use working credentials like these to attempt logins on banking, email, and social media accounts too, a technique known as credential stuffing. A successful match can lead to fraudulent purchases, drained gift card balances, or a full identity theft situation built from your saved personal details.

How Combolist Leaks Work

A combolist compiles email and password pairs, typically formatted as email:password, often with the login URL attached so attackers know exactly where to use them. These lists are usually built from older breaches or malware that harvests saved logins, then repackaged and shared on channels like Telegram. Because retail accounts are a common target, "shopping" combolists like this one are traded specifically for their potential to unlock stored payment details.

Check If You Are Affected

If you've shopped online with the email address you use most, it's worth checking. HEROIC's free breach scanner searches more than 400 billion exposed records, including this leak, so you can find out in seconds if your credentials are exposed and change them before someone else uses them to shop on your dime.