The ‘ArtHouse COMBO’ Leak Quietly Exposed 2.3 Million Accounts

2,295,211 Accounts Quietly Exposed in the "ArtHouse COMBO" Leak

On July 29, 2026, HEROIC analysts found a large combolist labeled "ArtHouse COMBO" circulating in a private Telegram channel, with little fanfare beyond the group where it was posted. The file contained 2,295,211 records pairing email addresses with plaintext passwords, along with URLs identifying the site each credential was captured from.

Why This Combolist Is Dangerous

With more than 2.2 million plaintext credential pairs in one file, an attacker has a massive, ready-to-use list with no cracking required. The URLs bundled with each record let an attacker quickly identify which site to target, and a file of this scale is valuable for large, automated login attacks across many websites at once.

What Was Exposed in the "ArtHouse COMBO" Leak

• Email addresses
• Plaintext passwords
• URLs identifying the site tied to each credential pair

Why This Matters Even Though It Happened Quietly

A leak does not need headlines to be dangerous. Files like this circulate silently among criminals long before most people ever hear about them, and automated bots can run all 2.29 million records against major websites within hours. If your credentials appear here and you have reused that password anywhere else, you face real risk of account takeover, identity theft, and financial fraud.

How Large Combolists Like This Get Assembled

Massive combolists such as this one are typically built by merging many smaller breaches, phishing hauls, and malware-stolen credentials into a single file, then labeled and quietly distributed through private Telegram channels rather than announced publicly. Buyers use automated tools to test every record against banking, email, retail, and social media platforms.

Check If You Are Affected

With over 2.29 million records in this leak, there is a real chance your information is included. HEROIC's free breach scanner checks your email against a database of more than 400 billion exposed records, so you can find out quickly and reset any passwords you may have reused.