One Upload, 98,616 Records: The BreachLock Mix Combolist Leak

In mid-July 2026, HEROIC analysts found a Telegram upload labeled 99.356 Mix BreachLock containing 98,616 records of email addresses, plaintext passwords, and the URLs where those credentials were originally used. Despite the name, this is not an official BreachLock product, it is a combolist packaged and shared under that label to appeal to buyers on dark web channels. Why is this dangerous? With nearly 100,000 plaintext credential pairs in one file, this is exactly the kind of dataset attackers use to run automated login attempts at scale. Every password is readable without cracking, and each one is already matched to an email address and a specific website, making it simple to attempt account takeover across a wide range of services in minutes. What was exposed: email addresses, plaintext passwords, and URLs tied to each set of credentials. Why this matters: a file of this size gives attackers enough volume to run large-scale credential stuffing campaigns against banks, retailers, and email providers. Even if only a small percentage of these accounts still use the leaked password, that is tens of thousands of potential account takeovers, fraudulent purchases, and identity theft cases. How this combolist was built: combolists like this one are typically assembled by combining data from multiple older breaches, phishing kits, and malware logs into a single file, then relabeled and marketed under a catchy or misleading name to attract buyers. Telegram has become a primary distribution point because large files can be shared to open channels quickly and with minimal oversight. Check if you are affected: with nearly 100,000 records in circulation, checking your exposure only takes a moment. HEROIC's free breach scanner searches your email address against more than 400 billion leaked records, including this BreachLock-labeled combolist, so you know immediately if you need to change a password.