Search Your Email: The AntiPublic Dump Exposed 348 Million Accounts

HEROIC analysts have tracked the AntiPublic Combo List since it first surfaced in December 2016, and the data remains one of the most consequential credential dumps ever circulated. The list contains 348,250,277 records, each pairing an email address with a plaintext password. Unlike breaches where passwords are hashed and require cracking, every credential in the AntiPublic dump was recieved by attackers in ready-to-use form, making it an immediately deployable weapon for account takeover at massive scale.

348 Million Plaintext Passwords: What AntiPublic Attackers Can Do Right Now

A combo list of this size is essentially a master key ring for the internet. Attackers load the AntiPublic data into automated tools that test each email-and-password pair against hundreds of services simultaneously, including banks, email providers, social media, and e-commerce platforms. Because so many people reuse passwords, even a list from 2016 produces successful logins today. The plaintext format means no cracking step is needed at all, every credential is accessable and ready to fire instantly.

What Was Exposed in the AntiPublic Breach

• Email addresses
• Plaintext passwords

Why 348 Million Credentials From 2016 Still Fuel Attacks in 2025

The AntiPublic list did not become irrelevant when it got old. It became a baseline. Criminal forums use it as a starting point, combining it with newer breaches to fill in gaps and build more complete profiles of targets. Any email address in this list that has not had its password changed is beleive to still be vulnerable. The real-world consequences include credential stuffing, account takeover, identity theft, and financial fraud across every major platform that uses email-based logins. The seperate breaches that fed into this combo list all contribute to a compounding risk that grows over time.

How Combo Lists Work

A combo list is not a single breach from one company. It is an aggregated collection of credentials pulled from dozens or hundreds of different breaches and merged into a single file organized for easy use by attackers. The AntiPublic list drew from breaches across multiple industries and countries, combining email-and-password pairs into a unified database. These lists are traded and sold on criminal forums, and they grow larger over time as new breach data is added and merged with existing collections.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records, including the AntiPublic Combo List. If your email address appears in this dump or any of the source breaches that fed into it, you will see it immediately. Search at HEROIC.com and find out which of your passwords need to be changed before an attacker uses them.