File #1025 Combolist Dump Leaks Nearly 1 Million Logins

HEROIC's analysts also tracked a companion file in the same series, File #1025 from the "1106.Url_Login_Password" collection, uploaded to Telegram in July 2024. This second file holds 946,398 records, each combining an email address, a plaintext password, and the URL of the site the credential was used on.

Why the File #1025 Leak Is Dangerous

Because the passwords in File #1025 are unencrypted, anyone who downloads the file can use it immediately without cracking a single hash. Paired with the exact login URL, the file functions like a checklist for account takeover: an attacker can go straight to the right website and try the exact password on file, with no trial and error required.

What the File #1025 Combolist Contains

• Email addresses
• Plaintext passwords
• URLs of the websites each credential unlocks

Why This Leak Matters to You

Nearly a million records in a single file gives criminals enormous scale to work with. Automated credential stuffing tools can test all 946,398 pairs against dozens of popular websites overnight, and every match becomes a potential account takeover, unauthorized purchase, or stolen identity. Even people who were not the original target can be swept up if they ever reused a password that appears on this list.

How the File #1025 Combolist Was Assembled

Files numbered and labeled like File #1025 are usually part of a larger batch pulled from multiple sources, including older breaches, phishing kits, and malware infections, then merged into a single list and distributed in bulk on Telegram. That numbering pattern is one reason a single Telegram channel can leak millions of credentials across dozens of files rather than one enormous dump.

Check If Your Email Is in the File #1025 Leak

HEROIC's free breach scanner lets you check your email address against more than 400 billion leaked records, including combolists like File #1025. Scan your email today, and if it appears, change that password right away on every site where you have reused it and enable two-factor authentication wherever it's offered.