The ‘amrb27’ Combolist Means 173,007 Passwords Are in the Wrong Hands

In late July 2026, HEROIC analysts identified a combolist tied to the handle amrb27 uploaded to Telegram. The file contained 173,007 records pairing email addresses with plaintext passwords, along with URLs showing which sites the credentials were used on. The data was verified as of July 28, 2026.

Why 173,007 Passwords in the Wrong Hands Is a Real Problem

At this size, the amrb27 combolist is large enough to power an automated attack campaign rather than a one-off attempt. Because the passwords are stored in plaintext, no cracking is required. Anyone who obtains this file can immediately begin testing each email and password pair, and for every person who reused that password on another site, the risk multiplies well beyond the original account.

What Was Exposed in the amrb27 Combolist

• Email addresses
• Plaintext passwords
• URLs tied to each set of credentials

Why This Matters

A list of this scale is exactly what criminals need to run credential stuffing at volume, feeding the email and password pairs into automated tools that test them against banking sites, email providers, and shopping accounts. With over 173,000 records involved, the chances of a real match are high, which opens the door to account takeover, identity theft, and financial fraud for a large number of people at once.

How a Combolist This Large Comes Together

Large combolists like this one are usually built by combining data from multiple older breaches, stealer malware infections, or previous credential-stuffing attempts, then cleaned up and organized into a single file. The URLs attached to each entry help a buyer quickly sort the list by target site. Files like the amrb27 combolist are traded on Telegram precisely because their size makes them valuable to anyone running large-scale account takeover attempts.

Check If You Are Affected

With more than 173,000 accounts in this leak, the odds that your email is included are meaningfully higher than in the smaller files HEROIC tracks. Our free breach scanner checks your email against a database of more than 400 billion leaked records, including this one, so you can find out immediately and change any exposed passwords before someone else uses them.