91K Mix DE Domains Leak Puts 87,456 Accounts at Fraud Risk

On 2 April 2023, a combolist titled "91K fresh Mix DE Germany Domains" surfaced on Telegram. Despite the "91K" in its name, the file HEROIC verified contains 87,456 records of email addresses, plaintext passwords, and associated URLs.

Why This Is Dangerous

Every credential in this file is stored in plaintext and ready to use. If you or anyone you know is among the 87,456 people in this list and has reused that password anywhere else, an attacker doesn't need to guess or crack anything, they can log straight in.

What Was Exposed

The "91K fresh Mix DE Germany Domains" combolist contains:

• Email addresses
• Plaintext passwords
• Associated URLs (the sites the credentials were collected from or tested against)

Why This Matters

Leaked email and password combinations like these are routinely used to commit fraud and identity theft. Once an attacker gets into an email account, they can reset passwords on banking, shopping, and social media accounts, and impersonate the victim to open new accounts or make unauthorized purchases. The consequences often extend well beyond the original leaked account.

How This Combolist Was Built

Files labeled "Mix" and "domains" like this one are typically compiled by combining credentials from multiple smaller breaches or malware logs, then sorted or filtered by the domain of the email address, in this case apparently German domains, so buyers can target a specific audience. Combolists are traded and re-traded on Telegram and dark web markets, often changing hands many times before HEROIC identifies them.

Check If You Are Affected

Don't wait to find out the hard way. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including this combolist, so you can change any at-risk passwords before someone else uses them.