Analysts Flag 208 Leaked Logins in Cipher1987 Combo Mix

Analysts Spot a Small, Freshly Uploaded Combo List

HEROIC analysts tracking Telegram breach channels flagged a file titled "Mix CIPHER1987" on July 11, 2026. Researchers found it contains 208 records, each combining an email address with a plaintext password and the URL the credentials were used on.

Why This Is Dangerous

Even a small leak like this one gives an attacker everything needed to log in immediately, since the passwords are stored as readable plaintext and are already matched to the site they unlock. Analysts note that smaller, freshly posted lists like this often go unnoticed by victims for longer, since large breaches tend to draw more public attention.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

Researchers point out that a smaller list does not mean smaller risk for the people affected. Each of the 208 accounts here is fully usable by anyone who downloads the file, and if any of these passwords were reused elsewhere, attackers can use credential stuffing to attempt account takeover on other services tied to the same person.

How "Mix" Combo Lists Like This One Get Made

Analysts trace lists like "Mix CIPHER1987" back to information-stealing malware logs, often nicknamed or tagged by the seller who assembled them, in this case with a personal or group identifier, "CIPHER1987." These smaller, custom-labeled combo lists are frequently shared for free among Telegram communities to build reputation before larger lists are sold.

Check If You Are Affected

Because small combo lists like this one are easy to overlook, checking your own exposure directly is the safest option. HEROIC's free breach scanner searches more than 400 billion leaked records, so you can confirm quickly whether your email and password appeared in this leak.