Researchers Link BreachLock Mix Dump to 90,862 Stolen US Logins

In July 2026, HEROIC analysts identified a combolist titled '91.531 Mix BreachLock' uploaded by a Telegram user. Researchers traced the file to 90,862 records pairing email addresses with plaintext passwords, along with the URLs each login was tied to, with accounts concentrated primarily in the United States.

Why the BreachLock Mix Dump Is Dangerous

The 'Mix' in the file's name reflects that it pulls credentials from multiple sources rather than a single site, giving attackers a broad set of targets in one place. Because the passwords are stored in plaintext and matched to specific URLs, anyone who obtains the file can attempt to log in immediately, without needing to crack anything.

What the BreachLock Mix Dump Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each account

Why This Matters

With 90,862 credential pairs in circulation, this dump is large enough to power sustained credential stuffing campaigns across many different websites at once. Because so many people reuse the same password, a single exposed login can cascade into account takeover on email, banking, or shopping accounts, leading directly to identity theft and financial fraud.

How a 'Mix' Combolist Like BreachLock Is Built

A mix combolist is assembled by combining credentials from several separate breaches, malware infections, or manual collection efforts into a single file, rather than focusing on one site or service. These combined files are then labeled, often with a name like 'BreachLock,' and traded or shared on Telegram channels and dark web forums, making them attractive to attackers who want the widest possible pool of accounts to target.

Check If You Are Affected

With over 90,000 records included in this leak, the chances that your credentials are among them are meaningful. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can find out quickly whether your password needs to change.