FROST TXT LOG 166 Leaks 7,766,313 Raw Plaintext Passwords

In November 2025, HEROIC analysts identified FROST TXT LOG 166, a combolist file uploaded to a Telegram channel that exposed 7,766,313 records pairing email addresses with plaintext passwords and web addresses. Nothing about these passwords is scrambled or hashed, so anyone holding the file can read them directly, and scanning your email is the only way to find out if yours is one of them.

Why This Is Dangerous

A password sitting in plain view next to an email address is ready to use the instant someone opens the file. If that password has ever been reused elsewhere, this leak alone hands an attacker a working key to any account that shares it, no cracking tools or guesswork required. The scale of this particular file means the risk is spread across millions of separate inboxes rather than a single company's customer list.

What Was Exposed

• Email Addresses
• Plaintext Password
• URLs

The practical fallout tends to include automated login attempts against email, banking, and shopping accounts, plus fraud carried out under a victim's name once an account is taken over. The URLs bundled into each record tell an attacker exactly where a given password was meant to be used, cutting straight past any guesswork.

Files like this are usually stitched together from many smaller credential leaks and device infections rather than pulled from one company's own systems, then bundled and passed around Telegram. That patchwork origin explains why one file can affect people with no connection to each other beyond a reused password.

See If You Are Exposed

Scan your email to check whether it shows up in this file. If it does, change that password wherever you have reused it and add two-factor authentication to your email and banking accounts first.

This applies equally to personal and work email addresses found in the same file.