Inside the disneyplus.com Combolist: How 5,543 Passwords Surfaced

The disneyplus.com Combolist: What HEROIC Analysts Found. HEROIC analysts identified a combolist referencing disneyplus.com that was uploaded by a Telegram user in May 2026. The file contains 5,543 records pairing email addresses with plaintext passwords, along with the URLs of the login pages those credentials belonged to. Why This Is Dangerous. Streaming accounts like this one are valuable to attackers because they can be resold or used directly, and because many people reuse the same password across their streaming service and other accounts. A leaked email and password pair here can be tried against banking, shopping, or other subscription sites in hopes the same login works. What Was Exposed: Email addresses tied to individual accounts. Plaintext passwords stored with no encryption. The URLs of the login pages those credentials were used on. Why This Matters. Even at 5,543 records, this is a real risk for the people affected. Because the passwords were stored in plaintext, anyone who obtains this file can read them directly, and if any of those passwords were reused elsewhere, those other accounts could be compromised through credential stuffing. How Combolists Work. A combolist is a file of matched email and password pairs, typically pulled from earlier breaches, phishing pages, or stealer malware and organized around a specific target, in this case a streaming service. Attackers build these lists by testing stolen credentials against a chosen site and keeping the combinations that successfully logged in, then share or sell the working list on platforms like Telegram. Check If You're Affected. If you have ever used your email address to sign up for a streaming or subscription service, HEROIC's free breach scanner checks it against a database of more than 400 billion leaked records so you can see in seconds if your information has been exposed.