The ‘500K 1’ Combolist Could Unlock Your Email and Bank Logins

HEROIC analysts identified a combolist called 500K 1 uploaded to a Telegram channel on December 24, 2022. The name implies roughly 500,000 records, and the verified count comes in close at 499,416, each pairing an email address or username with a plaintext password and a URL. Why This Is Dangerous: A single reused password rarely stays contained to one account. If your email and password pair appears in this file, an attacker can start with your email inbox, then move outward. One working login becomes the key to your banking app, your online shopping accounts, and your social media, especially if you've reused that password across more than one site. What Was Exposed: - Email addresses and usernames - Plaintext passwords - URLs tied to each login Why This Matters: With close to half a million credentials in one file, 500K 1 is exactly the kind of resource attackers use for large-scale credential stuffing runs, testing each pair against dozens of popular sites automatically. Even if you don't recognize the original source of this leak, your information can still end up in a combolist like this through data broker leaks, third-party breaches, or stealer malware you were never aware of. How a Combolist Like This Works: A combolist merges login data from multiple smaller sources, often old breaches or stealer log outputs, into one large file that's easier to trade or sell. Files named for their approximate size, like 500K 1, are common in Telegram trading circles, where volume itself is treated as a selling point regardless of how the data was originally obtained. Check If You Are Affected: Don't wait for a chain reaction to start with your accounts. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including combolists like 500K 1, so you can find out in seconds and lock down any exposed passwords first.