Analysts Link the 3.96KK Social Network Base Leak to 3.9 Million Accounts

HEROIC analysts identified a large combolist titled "3.96KK Social Network Base uhq" tied to an April 2023 upload from a Telegram user. The file contains 3,934,377 records of email addresses paired with plaintext passwords, along with the URLs those credentials were used on. Why This Is Dangerous: at nearly 3.9 million records, this is one of the larger combolists HEROIC has tracked recently. Every one of those records is a working, or once-working, email and password pair, stored in plain, readable text. That scale makes the file attractive to criminals running automated attacks across many accounts at once rather than targeting one person at a time. What Was Exposed: email addresses, plaintext passwords, and URLs tied to social network accounts. Why This Matters at This Scale: large combolists like this one are the fuel for credential stuffing campaigns, where attackers use automated tools to test millions of email and password pairs against banking, email, and shopping sites in bulk. Because so many people reuse the same password across multiple accounts, a single social network password leaking here can lead to accounts being taken over well beyond the original platform. How a Combolist This Size Gets Assembled: combolists of this scale are usually built by merging several smaller breaches and stealer log outputs into one master file, then cleaning and formatting the results as email and password pairs. The label uhq, short for ultra high quality, signals that the uploader has already verified many of these credentials still work, which makes the file more dangerous and more valuable to buyers on Telegram and dark web forums. Check If You Are Affected: with millions of records in circulation, the odds that your email address is one of them are real. HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records, so you can find out in seconds and take action before your reused password is used against you somewhere else.