One Upload. 4.48 Million Passwords. The ARCEUSULP Combolist Dump.

What HEROIC Analysts Found

In July 2026, HEROIC's threat intelligence team identified a large combolist labeled ARCEUSULP 86 5242187 after it was uploaded to Telegram by an individual user. The file contained 4,480,176 records pairing email addresses with plaintext passwords, along with the account URLs they were used with, making it one of the larger combolists this team has tracked recently.

Why This Is Dangerous

With more than 4.4 million entries, this file gives criminals an enormous pool of working email and password combinations to exploit. Because the passwords are stored in plaintext, anyone who downloads the file can read them exactly as typed, with no cracking or extra effort required.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated account URLs

Why This Matters

A combolist of this scale is exactly what powers large, automated credential stuffing campaigns, where attackers test millions of email and password pairs against banking, email, and social media logins in rapid succession. If your password appears here and you have reused it anywhere, the result can be account takeover, identity theft, or financial fraud, often before you even notice something is wrong.

How Combolists Work

A combolist pairs a username or email with a password, typically one pair per line in a plain text file. Large combolists like this one are usually assembled by combining data from multiple smaller breaches, stealer malware infections, and scraped login pages, then compiled into a single file and traded on Telegram channels and dark web forums. Their size alone makes them valuable to criminals running large-scale attacks.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion breached records, including large combolists like this one. If your information turns up, change that password right away and anywhere else you have used it.