Researchers Link Corps Part2 Combolist to 10,912 Stolen Logins

Corps Part2 5: Researchers Trace 10,912 Records to a Telegram Combolist

HEROIC analysts traced a combolist file labeled "Corps Part2 5" to a Telegram upload from May 2023. The "Part2" naming suggests it was released as a follow-up to an earlier file, and this installment alone contained 10,912 records pairing email addresses with plaintext passwords and the URLs each login was tied to.

Why This Is Dangerous

Because the passwords in this file are stored in plaintext, an attacker does not need to crack anything to use them, just open the file and start testing the email and password pairs against the matching URLs. Releasing a leak in multiple parts, as this one appears to be, also lets sellers keep buyers coming back, meaning more people may end up trading and testing these same 10,912 credentials over time.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

A combolist of this size gives attackers real scale for credential stuffing, testing each pair against banking sites, email providers, and other services hoping a password was reused. Anyone included in this leak faces a genuine risk of account takeover, and if enough personal detail can be gathered from the accounts reached this way, that risk extends to identity theft and financial fraud as well.

How Combolists Work

A combolist is a plain text file that pairs stolen usernames or email addresses with their matching passwords, typically gathered from earlier breaches, phishing pages, or malware and then bundled together for resale or free distribution. Sellers sometimes split a large dataset into numbered parts, as with this "Part2" release, to sustain interest and demand across multiple drops rather than releasing everything at once.

Check If You Are Affected

If you want to know whether your email address turned up in this leak, HEROIC's free breach scanner checks it against more than 400 billion leaked records, including combolists like this one. A quick search can tell you if you are exposed so you can change your password before someone else uses it.