Forbes_BF Logins Leaked: 1,057,714 Plaintext Passwords Found

A combolist tied to Forbes_BF surfaced online carrying 1,057,714 logins, each one an email address paired with a plaintext password and a URL. HEROIC analysts identified the file after it was shared for anyone to pull down.

Combolists like this one are built by gathering working email and password pairs from many sources and packaging them for reuse elsewhere. Once a file like this circulates, there is no way to know who has already copied it.

The only way to know for certain if your information is part of this exposure is to scan your email.

The Problem With Passwords Stored in Plain Text

When a password is stored or shared in plain text, it removes the one barrier that normally slows an attacker down. There is nothing to decrypt and nothing to guess. Combined with the email address and the URL the pair belongs to, this file gives an attacker a direct, working set of login instructions.

What Was Packaged Into This Leak

• Email Addresses: confirms which inbox each login belongs to, and is often reused as a username elsewhere.
• Plaintext Password: was stored in readable form, so it can be used to log in immediately without cracking.
• URLs: shows which site or service each email and password pair was meant to unlock.

How One Leaked Login Can Snowball Into Several

People often reuse the same password across email, banking and shopping logins without thinking twice. An attacker holding a confirmed working pair from this file has every incentive to try it elsewhere, turning a single leaked login into access across several of your logins at once.

How Files Like This End Up Circulating Publicly

Once an email and password pair is confirmed to work somewhere, it often gets added to a growing compiled list along with thousands of others. These lists get traded, resold and eventually posted publicly, which is the path this particular file appears to have taken.

What to Do Now About the Forbes_BF Leak

Begin by running a scan of your email against known leaks like this one. Wherever you reused the password tied to Forbes_BF, swap it out for something unique, since a plaintext leak like this one gives an attacker no reason to guess. This applies whether the email involved is a personal inbox or a work address, since either one can be reused elsewhere.