484,881 Wish Account Logins Leaked in 995 HQ Wish Combo

HEROIC analysts logged 484,881 records inside a Telegram file labeled "995 HQ Wish Combo," dated 13 Jul 2020. Each entry pairs an email address with a plaintext password and the login URL it opens, all tied to Wish shopping accounts based on the file's own label. A file this large is worth checking your address against right away.

Why this is dangerous

Almost half a million ready to use logins gives an attacker enough scale to automate credential stuffing across many services, not just the one the file was labeled for. Every password sits in plaintext, so there's no cracking delay between finding a record and trying it.

What was exposed

• Email addresses: the identifier tied to each of the 484,881 records.
• Plaintext passwords: readable and usable immediately.
• URLs: the login page linked to each credential pair.

Why this matters

A file labeled "HQ," meaning high quality, generally signals the seller already verified a sample of the logins work before posting, which raises the odds that a large share of these 484,881 records are still active. If your Wish login shares a password with any other account, that reuse is what turns a shopping account exposure into a bigger problem.

How a combolist like this gets built

Sellers assemble combolists like this one from credentials gathered through phishing pages, malware logs, and older leaks, then filter and test a portion before labeling the file for buyers. Naming it after a specific service, in this case Wish, tells buyers exactly what the logins are meant to unlock.

Is your login one of the 484,881 exposed here?

Scan your email to check it against this file and every other combolist HEROIC has logged. If your address matches, change that password now, including on any account where you used the same one, since a file this size gets tested widely. This applies just as much to a personal shopping account as it does to a work email address.