757,978 Records: More Than a Mid-Size City in the FR Combolist Leak

HEROIC analysts identified a dataset, tracked as COMBOLIST FR YAHOO ORANGE FRESH, that a Telegram user uploaded on 24-Oct-2025. The file contains 757,978 records, including email addresses, plaintext passwords, and the login page URLs tied to those accounts. As the name suggests, this is a combolist targeting Yahoo and Orange webmail accounts, compiled rather than pulled from a single company breach.

Why This Is Dangerous

Almost 758,000 records puts this combolist in the same range as the population of a mid-size city, all in a single file that attackers can run through automated tools in minutes. Each record pairs a working email address and plaintext password with the exact site it opens, ready for immediate use.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

Webmail accounts like Yahoo and Orange are often used to reset passwords and verify identity elsewhere, so a combolist this size gives attackers a large pool of potential entry points into other services. If a password from this file is reused, it can lead to credential stuffing, account takeover, and in more serious cases identity theft or financial fraud.

How Combolists Work

A combolist is built by combining email and password pairs from multiple sources, often older breaches, stealer log malware, and previously leaked databases, then merging and cleaning them into one large file. Sellers label combolists by provider, region, and freshness, as seen here with a batch targeting France, Yahoo, and Orange accounts and marked "fresh," before sharing them through channels like Telegram where buyers test them against real accounts.

Check If You Are Affected

If you want to know whether your information appears in this COMBOLIST FR YAHOO ORANGE FRESH file or any other breach, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a scan now and change any password that may have been exposed.