40K New USA Combolist: 37,428 American Logins Now Exposed

In May 2023, a Telegram user uploaded a combolist called "40K New USA," exposing 37,428 records of email addresses and plaintext passwords belonging to American users. Despite the name promising 40,000 entries, the actual file holds just over 37,000 working credential pairs, still enough for a serious wave of account takeover attempts.

Why the 40K New USA Combolist Is Dangerous

This list was built specifically around United States accounts, which means the services attackers target with it, banks, retailers, email providers, are likely ones you actually use. The passwords are stored in plaintext, so there is no scrambling to undo before a criminal can try logging in with your exact credentials.

What Was Exposed in the 40K New USA Leak

• Email addresses
• Plaintext passwords
• URLs linked to the accounts

Why This Matters

Combolists focused on a single country tend to get reused against the most popular services in that market, meaning your email provider, streaming accounts, or online banking could all be tested with the same stolen password. If you have reused a password anywhere, this leak raises the odds it gets tried somewhere that matters.

How Combolists Work

A combolist pairs an email or username with a password, typically gathered from past breaches, malware-infected devices, or phishing pages and compiled into one file. Criminals load lists like 40K New USA into automated software that rapidly tests each pair against many websites, a technique called credential stuffing. Country-specific combolists are especially efficient for attackers because they can aim the list directly at services popular in that region instead of guessing blindly.

Check If You Are Affected

Find out now whether your details are part of the 40K New USA combolist instead of waiting for a warning sign. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists like this one, so you can act before an attacker does.