The buffet24 Combolist Contains Exactly 3,422 Email and Password Pairs

HEROIC analysts identified a combolist file named “buffet24” that was uploaded to a Telegram channel on 10 September 2023. The file contains exactly 3,422 records, each one an email address paired with a plaintext password and the URL of the site or service that credential was used on.

Why This Is Dangerous

The passwords in this list are not encrypted or hashed, they are stored as plain, readable text. That means anyone who obtains the buffet24 file does not need to crack a single password. They can copy each email and password pair and start testing it against other websites immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tying each credential to the account it unlocks

Why This Matters

A precise count like 3,422 records might look small next to headline-grabbing mega-breaches, but every one of those records is a working set of login credentials for a real person. Attackers feed lists like this into automated credential stuffing tools that try each pair across email providers, banks, and social platforms. Anyone who reused their buffet24 password elsewhere is exposed to account takeover, identity theft, and financial fraud that has nothing to do with the original source.

How This Combolist Was Assembled

A combolist is not a single breached database, it is a compiled file of email and password pairs pulled together from multiple sources, old leaks, phishing pages, and malware, then packaged and shared for anyone looking for working logins. The buffet24 file, uploaded to Telegram and now circulating among people trading combolists, fits this pattern precisely.

Check If You Are Affected

You do not have to guess whether your email is one of the 3,422 exposed. HEROIC's free breach scanner checks your email against more than 400 billion breached records, including this combolist, so you can see exactly what has been leaked and change any reused passwords before someone else logs in first.