Inside the 4M COMBOLIST USA Leak: 4.5M Records Exposed

HEROIC's threat intelligence team identified a large combolist titled "4M COMBOLIST USA MIX FRESH AGLELAN" circulating on Telegram, dated April 28, 2025. The file contains 4,532,259 records pairing email addresses with plaintext passwords and the URLs those logins belong to.

Why the 4M COMBOLIST USA Leak Is Dangerous

At more than 4.5 million records, this is one of the larger combolists HEROIC has tracked recently. Because every password is stored in plaintext, attackers can run the entire file through automated tools and test it against major websites within hours, with even a small success rate translating into thousands of compromised accounts.

What Was Exposed in the 4M COMBOLIST USA Combolist

• Email addresses
• Plaintext passwords
• URLs of the websites or services the credentials belong to

Why This Combolist Matters

A file of this scale poses risk to a huge number of people at once. Anyone whose credentials appear here is exposed to credential stuffing, and if their password is reused on an email, banking, or shopping account, that reuse can lead directly to account takeover, financial fraud, or identity theft carried out through the compromised accounts.

How a Combolist Like This Works

A combolist this size is typically assembled by merging many smaller breaches, stealer logs, and older leaked databases into one master file, then labeled by size and region, as this one is with "4M" and "USA." Combolists of this scale circulate on Telegram and dark web marketplaces as premium products because their volume makes even a modest success rate highly profitable for attackers.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including large combolists like this one. If you find a match, change that password today and make sure it is unique to that one account going forward.