The AOL USA Combolist Leak: 569,134 Passwords Exposed. Check Yours.

HEROIC analysts uncovered a large combolist labeled "608K Private AOL USA Domain" that a Telegram user uploaded on April 2, 2023. Despite the "608K" in its name, the verified file actually contains 569,134 records, each pairing an AOL email address with a plaintext password and the URL the credentials unlock. Why this is dangerous: with more than half a million plaintext credentials in one file, this is not a hypothetical risk, it is a ready-made attack list. AOL accounts are often decades old and tied to a person's earliest online identity, meaning they may be linked to old financial accounts, forgotten subscriptions, and recovery emails for other services still in use today. What was exposed: the dataset includes AOL email addresses, plaintext passwords with no encryption protecting them, and the URLs tied to each account, giving attackers a complete, working login for every one of the 569,134 records. Why this matters: a breach of this size gives criminals enough volume to automate attacks at scale. Using bots, an attacker can run credential stuffing across banking sites, retail accounts, and social media platforms in bulk, testing every one of the 569,134 logins within hours. Because AOL accounts are frequently used as a backup or recovery email, a single compromised login can cascade into account takeover, identity theft, and financial fraud across several other services. How a combolist of this size gets built: large combolists like this one are usually compiled by merging smaller breaches, stealer log dumps, and phishing hauls that share a common trait, in this case the AOL domain. Criminals sort credentials by email provider because it lets buyers target one platform's users specifically, and files like this circulate on Telegram and dark web marketplaces long before they attract public attention. Check if you are affected: if you have or have ever had an AOL email address, do not assume your account is too old to matter, this leak proves otherwise. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can find out in seconds and change your password before someone else logs in first.