The ’61k Userpass Gaming’ Combolist: 38,710 Gamer Logins Exposed

HEROIC analysts found a gaming-focused combolist, labeled "61k userpass Gaming," posted to Telegram on 28-Dec-2022. Despite the name, the file contains 38,710 verified records, each pairing an email address with a plaintext password, along with URLs tying the credentials to gaming platforms and related sites.

Why This Is Dangerous

Gaming accounts are frequently linked to stored payment methods, wallet balances, and valuable in-game items and currency, all of which can be sold or drained by anyone who logs in with a stolen credential. Because the passwords here are stored in plaintext, an attacker does not need to crack anything, they can start logging into accounts the moment they open the file.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

With 38,710 credential pairs to work with, attackers can run large-scale credential stuffing against gaming platforms and any other site where a victim reused the same password. A hijacked gaming account can mean stolen wallet funds, resold in-game items, and a locked-out owner, and if the same password unlocks an email or banking account elsewhere, the damage extends into account takeover and financial fraud far beyond the original game.

How This Combolist Was Compiled

Gaming combolists like this one are usually built by running previously leaked email and password combinations through automated checker tools aimed at specific gaming platforms, keeping only the pairs that successfully authenticate. The confirmed working logins are then bundled into a file and traded on Telegram, often labeled with an approximate count and a target category like "Gaming" to advertise what buyers can expect to find inside.

Check If You Are Affected

If you play games online, it is worth checking whether your email address appears in this leak or in any of the other breaches HEROIC has cataloged. HEROIC's free breach scanner searches a database of more than 400 billion exposed records in seconds. If you find a match, change that password immediately, both on the gaming platform and anywhere else you may have reused it.