The AOL.COM Base2 Leak Exposed 402,782 US Email Accounts

HEROIC Analysts Uncover the AOL.COM Base2 Combolist

HEROIC's dark web monitoring team identified a combolist named "AOL.COM Base2" that was uploaded to a Telegram channel on January 18, 2023. The file contains 402,782 records pairing email addresses with plaintext passwords and the URLs those credentials unlock, all tied to AOL email accounts.

Why This Is Dangerous

Every password in this combolist is stored in plaintext, meaning anyone who opens the file can read and reuse the credentials instantly, no cracking required. Because the entries are matched to AOL's login URL, an attacker has a direct path into 402,782 inboxes, and email access alone is often enough to reset passwords on other accounts tied to that address.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each credential pair to the account they unlock

Why This Matters

An exposed email account is one of the most valuable targets for an attacker, since it's frequently used to verify identity and reset passwords elsewhere. With 402,782 AOL accounts in this file, attackers running credential stuffing attacks have a large pool to work through, and any reused password puts banking, shopping, and social accounts at risk of takeover, identity theft, and financial fraud.

How Combolists Work

A combolist packages email or username and password pairs into a single file, usually organized around the type of account it targets, in this case AOL.com addresses. Files like "AOL.COM Base2" are traded on Telegram and dark web forums precisely because sorting by provider makes it faster for buyers to run large-scale login attempts.

Check If You Are Affected

If you have or ever had an AOL account, it's worth checking now. HEROIC's free breach scanner compares your email address against a database of more than 400 billion leaked records, including combolists like AOL.COM Base2, so you can confirm your exposure in seconds and change your password if needed.