Anyone Using aotg.com Should Check This 1,357 Login Leak

Anyone with an account on aotg.com should know that 1,357 logins tied to the site turned up in a plaintext combolist HEROIC analysts reviewed in December 2020. Each record pairs an email address with a readable password and a URL pointing to the login page.

Why this is a real risk, not just noise

Because the passwords are stored in plaintext, there's no cracking step standing between an attacker and a working login. Anyone who obtains the file can start testing credentials immediately.

What was exposed

• Email addresses, used to identify and target specific account holders
• Plaintext passwords, usable the moment the file is opened
• URLs, pointing directly at the login page tied to each credential

Why aotg.com users should pay attention

If you've ever created an account on this site with a password you've used elsewhere, this exposure extends past aotg.com itself. Attackers count on that overlap to turn one leaked file into access on several accounts. The URL included with each record only makes that easier, since it removes any need to guess where a given password was originally used.

How a combolist like this gets made

Combolists are compiled, not hacked from scratch in the moment they're shared. Someone gathers matching credentials from earlier leaks and stealer infections, merges them into one file, and distributes it for reuse attacks, usually with little regard for which original site each pair came from.

How can you check if you're exposed?

Use a free scan your email to see whether your address appears in this file or any other HEROIC has tracked. If it does, change the password tied to that account first, then update it anywhere else you've reused it, and turn on two factor authentication if the service offers it. This applies to work inboxes as well as personal ones.