5M MIX Leak: 4.5 Million Email and Password Users Targeted

5M MIX: Who Is Actually at Risk From This 4.5 Million Record Leak

HEROIC analysts logged a combolist titled "5M MIX," uploaded to a Telegram channel and added to our breach intelligence database. The file contains 4,499,781 records of email addresses paired with plaintext passwords and the URLs they unlock. The credentials inside were leaked on 18 February 2025.

Why This Is Dangerous

At nearly 4.5 million records, this is one of the larger combolists HEROIC has tracked in this batch. Every entry pairs a working email, a readable password, and a URL, which means an attacker does not have to guess where the login works. Anyone whose email appears here, regardless of what site the credentials originally came from, is a target simply by being in the file.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

With a list this size, attackers do not need to target anyone specifically. They run automated credential stuffing scripts across the entire file, checking which email and password pairs still work on banking, shopping, and social media sites. If your password was reused anywhere, you are just as exposed as someone deliberately targeted, and the outcome can range from account takeover to identity theft and financial fraud.

How a Combolist Like This Gets Built

A combolist this large is usually stitched together from multiple smaller leaks, malware logs, or previous breach dumps, then merged into one file and given a simple catalog name like "5M MIX." The size is the point: bigger lists give attackers more chances to find working logins.

Check If You Are Affected

With 4,499,781 records in this single file, it is worth checking whether your email is among the more than 400 billion records in HEROIC's breach database. Run a free scan with HEROIC's breach scanner to see if your email shows up in this leak or any other, and change any passwords that come back exposed.