HEROIC Analysts Found the COMBOLIS 110K USA MIX Leak on Telegram

HEROIC analysts found a combolist titled "COMBOLIS 110K USA MIX FRESH 100" circulating on a private Telegram channel on 04-Apr-2026. The file contains 97,348 records tied to United States accounts, pairing email addresses with plaintext passwords and the URLs of the sites those logins came from.

Why This Is Dangerous

The passwords in this file are stored as plaintext, so there is no cracking step standing between an attacker and a working login. Paired with the site URL, the combination tells an attacker exactly which account to try the credentials on. If the person behind that email reuses the same password on other accounts, banking, email, or shopping sites could all be at risk from the same leaked pair.

What Was Exposed in the COMBOLIS 110K USA MIX File

• Email addresses
• Plaintext passwords
• URLs of the sites where the credentials were used

Why This Matters for US Accountholders

A list of 97,348 working email and password pairs is small enough to be tested manually but large enough to automate, which makes it useful for credential stuffing against banks, email providers, and online retailers. When a password still works, attackers gain account takeover, and from there identity theft or financial fraud often follows, especially where the account is linked to saved payment details.

How This Type of Combolist Gets Compiled

A combolist is a curated set of email and password pairs pulled from sources like phishing pages, malware infections, or older breaches, then grouped by country or theme to make the data more appealing to buyers. The "USA MIX" label indicates the credentials were filtered specifically for US-based accounts, while "fresh" tells buyers the list is newly assembled and has not yet been checked against known compromised password databases.

Check If You Are Affected

If you have US-based online accounts, it is worth checking whether your email address appears in this leak or any other breach HEROIC tracks. HEROIC's free breach scanner searches more than 400 billion leaked records so you can quickly see if your information has been exposed and what to do next.