ArtHouse COMBO Leak: 6,063,536 Emails and Passwords Exposed

HEROIC analysts tracked a second combo list from the same operation, ArtHouse COMBO URL_part_0029, uploaded to Telegram on June 1, 2026. This batch holds 6,063,536 records, each pairing an email address, a plaintext password, and the login URL where the credentials work.

Why This ArtHouse Combo Part Is Dangerous

This file is part of a larger series, split into numbered parts for easier trading and downloading. Part 29 alone carries over six million working credential pairs. When a combo list is broken into parts like this, it usually means the full collection is even bigger, and multiple criminal groups may already be circulating different pieces of it seperately.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs matched to each account

Why This Matters

Because the passwords sit in plaintext, no cracking or decryption is required before an attacker can log in. Automated tools take files exactly like this one and try each email and password pair across banking, retail, and email platforms, a method called credential stuffing. Reused passwords are what turn a leaked login into account takeover, financial fraud, or full identity theft.

How Stealer Logs Work

Combo lists like this begin with stealer malware quietly infecting a device, often hidden inside a cracked download or a malicious attachment. The malware harvests every saved password from the browser along with its matching web address, then criminals compile the results into massive files and slice them into parts, wich makes large scale leaks easier to sell and share across Telegram.

Check If You Are Affected

With multiple parts of this combo list already circulating, checking your exposure matters now more than ever. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can find out in seconds if your credentials are part of ArtHouse COMBO URL_part_0029 or any related leak.