AOL.ch Combolist Exposes 949 Webmail Email and Password Pairs

In June 2026, HEROIC analysts identified a combolist titled aol.ch - 949 emails, uploaded to Telegram by an anonymous user. The file contained 949 records, each pairing an email address with a plaintext password, with many entries also including the login URL the credentials were tied to. The naming makes clear this list was compiled specifically around AOL email accounts.

Why This Is Dangerous

Webmail providers like AOL sit at the center of a person's online identity, since password resets for banking, shopping, and social media accounts typically get sent there. With the passwords in this file stored in plaintext, an attacker does not need to crack anything, they can attempt to log in immediately, and a successful login on an email account can quickly cascade into access on every other service tied to that inbox.

What Was Exposed

Based on verified data from this listing, the following information was included:

• Email addresses
• Plaintext passwords
• URLs linked to the associated accounts

Why This Matters

Email-focused combolists like this one are especially valuable to attackers running credential stuffing campaigns, since an email login often unlocks more than the inbox itself. If any of these 949 AOL users reused their password on another site, or if their email account is used as a recovery method elsewhere, that single leaked password can lead to account takeover, identity theft, and financial fraud across accounts that have nothing to do with AOL at all.

How Combolists Are Built

A combolist like aol.ch - 949 emails is assembled by collecting email-and-password pairs from previous leaks, phishing pages, or malware infections, then filtering them down to a specific provider, in this case AOL. The person who uploads it does not need to have breached AOL directly. They simply gather credentials that were exposed elsewhere and package them by email domain, which makes the list more useful and easier to sell to attackers targeting a specific type of account.

Check If You Are Affected

If you have an AOL email address, it is worth finding out whether your login appears in this leak or any other. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can search in seconds and change your password if it turns up exposed.