150 Logins Leaked Via the advertise-noreplysupport.facebook.com File

HEROIC analysts found a combolist in January 2026 named advertise-noreplysupport.facebook.com, containing 150 records that pair an email address with a plaintext password and the web address each one logs into. The quickest way to see if you are affected is to scan your email.

Readable Passwords Mean Instant Access

Because the passwords in this file were never encrypted, anyone who opens it can read each one directly. There is no extra step between finding a record and trying it on the matching account. With the login URL included, an attacker does not even need to search for where the password belongs.

Each of the 150 Records Carries the Same Three Fields

• Email Addresses: identifies the account holder and gives attackers a name to target with phishing attempts.
• Plaintext Password: fully readable, which means it can be used right away on this account and anywhere else it was reused.
• URLs: links each password to its exact login page, cutting out the guesswork for anyone using the file.

150 Records Is Small, But the Risk Is Not

A file of 150 records is modest compared to larger leaks, but each one still represents a working set of login details. An attacker only needs one of these 150 to get into an account, and from there they can lock out the real owner or use the access to reach other accounts tied to that email. Size does not reduce the damage a single successful login can do.

How a List Like This Gets Put Together

A combolist is built by gathering email and password pairs that were already in circulation, often because the same password had been used on more than one site. Someone collected these 150 pairs, confirmed which login URL each one matched, and combined them into one file. The process relies on reused passwords rather than any new intrusion.

Find Out if You're Among the 150

Scan your email to check whether your address appears in this file. If it does, change that password now, and change it anywhere else you have used it before. It is worth running this check on both your personal email and any work email you use.