539,654 Passwords Leaked in the 587K Microsoft HQ Combo Dump

In June 2026, HEROIC analysts identified a combolist file titled "587K Microsoft HQ Combo" circulating on a Telegram channel. The file's name suggests roughly 587,000 records, but HEROIC's verification found 539,654 actual entries, each pairing an email address with a plaintext password and the URL of the login page it unlocks. We are noting that discrepancy here rather than repeating the inflated file name, since the real, confirmed number is still significant on its own. Why This Is Dangerous: Every password in this file is stored in plain text, so there is no encryption or hashing standing between the data and anyone who downloads it. Each entry also comes with the exact URL of the account it belongs to, meaning an attacker does not need to guess where a stolen password works. They can open the link and try to log in immediately. What Was Exposed: - Email addresses - Plaintext passwords - URLs for the associated login pages Why This Matters: With more than half a million credential pairs in a single file, the odds that some of these passwords are reused on other accounts are high. Attackers commonly take lists like this and run them against banking sites, webmail providers, and shopping platforms in a tactic called credential stuffing, hoping that at least a fraction of the reused logins still work. How Combolists Work: A combolist is a compiled file of email or username and password combinations, often assembled from a mix of older breaches, stealer logs, and prior leaks, then merged and redistributed as a single package. Unlike a stealer log pulled straight from one infected device, a combolist can blend records from many different sources, so some entries may be stale while others are still active. That mix of old and new is exactly why sellers on Telegram and dark web forums package and share them so widely. Check If You Are Affected: The only way to know for certain if your information is part of this leak is to check directly. HEROIC's free breach scanner searches a database of more than 400 billion breached records, including combolists like this one, so you can find out in seconds whether your email or password has been exposed and take steps to secure your accounts.