COMBOLIST 400K SHOPPING FRSH 100 Exposes 399,927 Passwords Now

HEROIC analysts found a combolist labeled "COMBOLIST 400K SHOPPING FRSH 100" being shared by a Telegram user. Dated 18-Dec-2025, the file contains 399,927 records, including email addresses, plaintext passwords, and the URLs of the shopping accounts those passwords open.

Why This Shopping Combolist Is Dangerous

This file was specifically packaged around shopping accounts, which means the URLs inside point directly to retail and e-commerce logins rather than a random mix of sites. That focus matters because shopping accounts often have saved payment methods and stored addresses attached. An attacker who logs in doesn't need to steal a credit card number separately, they can potentially place orders or change account details using the payment info already saved on file.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each shopping account

Why This Matters

Because the passwords are stored in plaintext, they work immediately, no cracking required. For the 399,927 records in this file, the immediate risk is account takeover on shopping platforms, followed by financial fraud if a saved payment method gets used without permission. There's also a secondary risk: anyone who reused this password on other sites is exposed to credential stuffing attacks well beyond the original shopping account.

How Combolists Work

A combolist is a curated file of email-and-password pairs, often pulled together from multiple stealer logs and prior leaks, then organized around a theme like a website category to make it more appealing to buyers with a specific target in mind. Labeling a file "fresh" signals the credentials were gathered recently and are more likely to still be active. These packaged files are then shared or sold on platforms like Telegram, ready for anyone to start testing logins immediately.

Check If You Are Affected

Don't wait to find out if your shopping accounts were part of this. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including combolists like this one, and tells you right away if you were affected. If you were, change that password now, review your saved payment methods, and turn on two-factor authentication before anyone else gets the chance to use your account.