The COMBOLIS 116K Gmail Leak Compiled in April Just Surfaced

The combolist behind this exposure, titled "COMBOLIS 116K GMAIL FRESH 100," was compiled and uploaded to a Telegram channel on 04-Apr-2026. HEROIC analysts have now cataloged the file, which contains 164,918 records tied to Gmail accounts, pairing email addresses with plaintext passwords and the URLs of the sites those credentials were used on. Months can pass between when a list like this is first assembled and when it becomes widely known, giving criminals a head start before the exposure is public.

Why This Is Dangerous

Because the passwords are stored in plaintext, no cracking is required, anyone with the file can read the password next to its matching email address instantly. Add the URL of the site each login was captured on, and an attacker has a direct path into that account. The longer a list like this circulates quietly before wider detection, the more time criminals have to test the credentials before account owners think to change their passwords.

What Was Exposed in the COMBOLIS 116K GMAIL File

• Email addresses (Gmail accounts)
• Plaintext passwords
• URLs of the sites where the credentials were used

Why This Matters for Gmail Users

A file of 164,918 email and password pairs is exactly the kind of resource used in credential stuffing, where automated tools try the same login across many different sites in hopes that it was reused. If a match hits, the result is account takeover. Because Gmail addresses are often used to reset passwords and receive verification codes for other accounts, a compromised Gmail login can quickly cascade into identity theft or financial fraud elsewhere.

How Combolists Like This Circulate Before Going Public

A combolist is typically built from a mix of sources, malware infections, phishing pages, or older breaches, then organized by domain or region for resale. Sellers often share these files privately in small Telegram groups first, testing demand and reselling the same list to multiple buyers before it becomes more widely known. By the time a list surfaces broadly, as this one has, it may already have been used against a number of the accounts it contains.

Check If You Are Affected

If you use a Gmail address, it is worth checking now whether it appears in this exposure. HEROIC's free breach scanner searches more than 400 billion leaked records to quickly show you if your information has been compromised and what steps to take next.