aol.it – 14.420 emails uploaded by a Telegram User: 14,420 Exposed

HEROIC analysts identified a combolist labeled "aol.it - 14.420 emails," uploaded to a Telegram channel on June 10, 2026. The file contained 14,420 records pairing email addresses with plaintext passwords and the URLs of the accounts they access.

Why This Combolist Is Dangerous

Because the passwords in this file are stored in plaintext, anyone who obtains it can read and reuse every credential immediately, with no decryption or cracking needed. The included URLs tell an attacker exactly which website each email and password pair unlocks, turning a simple text file into a ready-made tool for breaking into accounts at scale.

What Was Exposed

• Email addresses
• Plaintext passwords
• Account URLs

Why This Matters

If any of your passwords appear in this list, and you have used that same password anywhere else, attackers can walk straight into those accounts too. Combolists like this one fuel credential stuffing attacks, where automated scripts test each email and password pair against banking sites, email providers, and social media until one works. The result can be account takeover, drained funds, or stolen identity, often without the victim noticing until real damage is done.

How Combolists Work

A combolist is a plain text file pairing usernames or email addresses with their matching passwords, usually pulled from older leaks, phishing pages, or infected devices and then bundled together for easy reuse. Attackers favor combolists because they skip the hard part of hacking entirely: instead of breaking into a system, they simply feed the list into automated login tools and let the software find every account where the credentials still work.

Check If You Are Affected

With 14,420 email and password pairs now in circulation, it takes seconds to check whether yours is one of them. HEROIC's free breach scanner searches more than 400 billion leaked records, including this combolist, so you can find out immediately if your credentials were exposed and change your passwords before anyone else uses them.