Picture 24.6 Million Logins Exposed in AMRTECH-TXTLOG-ULP-FREE-64 1

Picture a single file holding 24,592,685 email and password pairs, each one tagged with the site it unlocks. That's what HEROIC analysts found in a combolist called AMRTECH-TXTLOG-ULP-FREE-64 1, dated January 20, 2026. Scan your email to see if your address is one of the 24,592,685 listed.

Every password in this file is stored in plain, readable text, so there is no cracking step between an attacker and a working login. At nearly 25 million records, the file gives attackers enormous scale to automate attempts across many other sites at once.

What's Packed Into AMRTECH-TXTLOG-ULP-FREE-64 1

• Email Addresses: Confirms a working account an attacker can target directly.
• Plaintext Passwords: Immediately usable, with no cracking required.
• URLs: Identifies the exact site each email and password pair unlocks.

What a List This Large Makes Possible

At this scale, attackers typically run automated tools that test each pair against banking sites, email providers, and shopping accounts, hoping for reused passwords. Even a small success rate across 24.6 million records still means a large number of accounts exposed to takeover, fraud, or a hijacked email used to reset other logins. Files like this one are also frequently re-shared and recombined with other leaked lists, which can keep old, already exposed passwords circulating long after the original file first appeared, especially when a password was never changed.

How a Combolist of This Size Gets Built

Combolists like this are assembled by merging email and password pairs from many sources into one organized file, often grouped by the site each pair logs into. Once compiled, files of this size circulate widely so anyone holding them can test the credentials elsewhere.

Responding to the AMRTECH-TXTLOG-ULP-FREE-64 1 Exposure

Scan your email to check your exposure. If you're included, change that password everywhere you've reused it, starting with email and financial accounts, and turn on multi factor authentication where it's available. This matters for work email just as much as personal accounts.