The BRAZIL LEADS CIPHER1987 Dump Exposed Exactly 8,318 Login Pairs

HEROIC analysts identified a combolist named "BRAZIL LEADS CIPHER1987" that a Telegram user uploaded on August 6, 2026. The file contains exactly 8,318 records pairing email addresses with plaintext passwords and associated URLs, cataloged in HEROIC's system as tied to United States accounts.

Why the BRAZIL LEADS CIPHER1987 Dump Is Dangerous

Every one of the 8,318 records in this file hands an attacker a working email address, its exact password in plain text, and the URL where the login was captured. There is nothing to decrypt or guess. Anyone who downloads this file can start testing those logins against real accounts right away.

What Was Exposed in This Combolist

• Email addresses
• Plaintext passwords
• URLs linked to each account

Why This Matters

Lists labeled as "leads" are often built for marketing or sales targeting, which means the accounts inside may be tied to real names, phone numbers, or other personal details beyond just an email and password. If any of these 8,318 people reused their password on a bank, email, or shopping account, attackers can attempt credential stuffing to break into those too, opening the door to identity theft or financial fraud.

How a Combolist Like This Gets Built

A combolist pairs stolen usernames or emails with matching passwords, usually collected from phishing pages, malware infections, or earlier breaches and then repackaged into a single file. The "CIPHER1987" tag in the file's name suggests it was compiled or branded by a specific source, one that appears responsible for multiple similarly labeled files circulating on Telegram.

Check If You Are Affected

If you want to know whether your email address is part of this combolist or any other breach, HEROIC's free breach scanner checks your information against a database of more than 400 billion breached records, giving you a clear answer in seconds.