The COMBOLIST 854K CANADA MIX FRESH 100 Leak Exposed Your Passwords

In January 2026, HEROIC analysts identified a stealer log file circulating under the name COMBOLIST 854K CANADA MIX FRESH 100, uploaded to a Telegram channel by an individual user on 6 January 2026. The file contains 414,001 records linked primarily to Canadian accounts, pairing email addresses with plaintext passwords and the exact website URLs those logins unlock.

Why Your Login Details Could Already Be in This Leak

This file does not just list stolen passwords, it lists them next to the exact login page they belong to. That means an attacker does not have to guess where a password might work. They can open the URL, enter your email and password, and be inside the account within seconds, because the credentials were captured in plaintext straight from an infected device rather than hashed or encrypted.

What the COMBOLIST 854K CANADA MIX FRESH 100 Leak Contains

• Email addresses used as account usernames
• Plaintext (unencrypted) passwords
• The specific login URLs each credential pair works on

Why This Matters If You Reuse Passwords

414,001 matched login pairs is more than enough for automated credential stuffing attacks, where the same email and password combination is tested against banking, email, retail, and social media sites. If you have ever reused a password across accounts, one exposed pair from this leak could be all it takes for someone to take over an account, steal your identity, or commit financial fraud in your name.

How Stealer Log Malware Builds Combolists Like This One

Stealer logs like this one come from infostealer malware, malicious software that infects a device through a fake download, cracked software, or phishing link. Once installed, it quietly scans the browser for saved passwords, autofill data, and session cookies, then sends everything back to the attacker. Criminals merge thousands of these individual infections into a single file, label it as a fresh batch (the "FRESH 100" tag seen here), and sell or share it through Telegram channels like the one this file surfaced from.

Check If Your Email Appears in This Stealer Log

With 414,001 records already circulating, the safest move is to check your own exposure directly. HEROIC's free breach scanner checks your email against more than 400 billion breached records, including stealer logs like this one, so you can see whether your credentials are affected and act before someone else does.