7.1_rand_691_10000 Leak: 9,945 Logins Exposed Since April 2026

HEROIC analysts identified a combolist file named 7.1_rand_691_10000 that a Telegram user uploaded on April 3, 2026. The file name suggests a random sample pulled from a larger set, and it contains 9,945 records of email addresses, plaintext passwords, and the URLs those credentials were collected from. Why This Is Dangerous: Random sample files like this one are often used as a preview or proof of a larger stolen dataset, distributed to build trust before a bigger sale. That means the credentials inside are frequently fresh and untested against security defenses, giving attackers a head start before victims have any reason to suspect their accounts were compromised. What Was Exposed: - Email addresses - Plaintext passwords - URLs linking each pair to its source Why This Matters: Even at under 10,000 records, a file like this is enough to automate credential stuffing attacks against thousands of individual accounts. Anyone reusing a password across sites risks account takeover, and from there, identity theft or financial fraud follows quickly once an attacker gains a foothold in email or financial accounts. How This Combolist Was Assembled: Naming conventions like '7.1_rand_691_10000' point to files generated by scripts that pull a random range of entries, in this case roughly numbers 691 through 10,000, out of a much larger combolist. Distributors release these samples in stealer log and combolist trading channels so buyers can verify quality before purchasing the full file. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including sample and full combolist files like this one, so you can find out immediately if your credentials appear in this exposure or any other.