Dark Web Intel: ‘Free 05-22’ Combolist Exposed 2.2 Million Logins

HEROIC analysts identified a large combolist labeled "free 05-22" uploaded to a Telegram channel on May 23, 2026. This file contains 2,208,701 records of email addresses paired with plaintext passwords and the URLs where those logins were used, making it one of the larger Telegram-sourced dumps HEROIC has tracked recently.

Why a Combolist This Large Is Especially Dangerous

At more than 2.2 million records, this file gives attackers enough working email and password pairs to run large-scale automated attacks rather than targeting people one at a time. Because the passwords are stored in plaintext, no cracking is needed. Anyone who downloads the file can immediately try each pair against the site listed in the URL.

What Was Exposed in the Free 05-22 Combolist

• Email addresses
• Plaintext passwords
• URLs linked to the accounts

Why This Matters at This Scale

A file of 2,208,701 credentials is built for automated credential stuffing, where attackers use bots to test each email and password pair against banking sites, email providers, and social media in bulk. If your details are among them and you reuse passwords, the result can be account takeover, identity theft, or direct financial fraud, often without you noticing until the damage is done.

How a Dump of This Size Gets Assembled

A combolist like "free 05-22" is built by combining email-and-password pairs from multiple older breaches, phishing campaigns, and malware infections into one master file. Files labeled "free" are often released publicly to build a seller's reputation before they charge for larger or more current combolists, which is why dumps like this one spread quickly once posted to Telegram.

Check If You Are Among the 2.2 Million Exposed

With a file this large in circulation, checking your exposure directly is the fastest way to know where you stand. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including large combolists like this one, so you can find out immediately and change any reused passwords before they are used against you.