The ATT Good for Direct TV Combolist Exposed 1 Million US Accounts

In January 2023, HEROIC analysts identified a combolist titled "ATT good for direct tv" circulating on Telegram. The file contained 1,026,106 records pairing email addresses with plaintext passwords and the URLs those credentials were used on.

Why This Is Dangerous

The file's name suggests these credentials were being marketed for use against AT&T and DirecTV accounts, but because the passwords are stored in plaintext and paired with source URLs, they can just as easily be tried against any other account tied to the same email address. No cracking is required. The credentials are ready to use as soon as the file is opened.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs

Why This Matters

Streaming, cable, and phone accounts are often linked to the same email address used for banking, shopping, and other logins. If your credentials appear in a file like this, attackers can use credential stuffing to test that same email and password across dozens of other services, turning one exposed login into a chain of account takeovers, financial fraud, or identity theft.

How This Combolist Was Built

A combolist marketed for a specific service, like this one labeled for AT&T and DirecTV, is typically built by filtering a larger batch of stolen credentials down to accounts associated with a particular provider. Criminals do this because pre-sorted lists sell for more and make it faster to target a specific type of account. Telegram is a common place for these curated lists to circulate.

Check If You Are Affected

With over a million records in this combolist, it is worth taking a minute to check. HEROIC's free breach scanner searches your email against a database of more than 400 billion leaked records, including this one, and tells you in seconds if you were affected. If you find a match, change that password right away and anywhere else you have reused it.