Inside the combo list: 170,941 logins and why reuse makes them risky

HEROIC analysts reported a file called combo list that contains 170,941 email and password pairs, with the passwords stored as plain text. The file is dated January 25, 2026, and it includes URLs for the sites where each pair was used. Your own address can be checked against the list with a scan of your email.

The most dangerous combination in this file is the three fields together: an address, a password that can be read, and the site it was used on. Taken separately they are less useful, but together they form a ready-to-use login that needs no further work from the attacker.

Why Reuse Turns a List Into a Threat

Each pair is valuable only if the password was used somewhere else. An attacker takes a pair from this file and tests it on the mail, shopping and financial sites where the same person might have logged in. One match is enough to start a takeover, and the attacker does not need to find more than one.

The effect grows when the matching password also protects a work tool or a main email address. Those are the logins that open the most doors, so reuse at those points carries the highest cost.

The Three Fields in Each Record

• Email addresses: identify whose inbox the password belongs to, so the attacker knows who they are targeting.
• Passwords in plain text: visible as stored, so they can be entered on other sites immediately.
• URLs: point to the place each pair was originally used, giving the attacker a starting site.

What the combo list Means for Your Inbox

An attacker who reaches your inbox can read messages, reset passwords on linked services and send messages that look like they come from you. Scam messages built from this information can be hard to spot because they include a real address and a password you may remember. The damage often spreads to contacts before the owner notices.

Financial risk is possible if the same password protects banking or payments. A stolen login can lead to unauthorized charges, transfers or new credit in your name, which is why the reused password matters most.

How a Combo List Is Put Together

A combo list is made by collecting email and password pairs from many places and combining them into one file. The collector wants to try each pair on other sites, since people who reuse passwords make those attempts succeed. The file has little value on its own; its worth comes from how often people keep the same password.

Should You Change the Password Where You Reused It?

Check the list with scan your email before anything else, then act on the result. If your address appears, replace the reused password one service at a time, beginning with email and banking, and make each new one unique.

Personal and work email alike call for the same response.