What We Know So Far About the FROST TXT LOG 168 Password Leak

In November 2025, HEROIC analysts identified a file known as FROST TXT LOG 168, a combolist uploaded to a Telegram channel that exposed 5,735,548 records. Each record paired an email address with a plaintext password and a web address. Because the passwords were stored in plaintext, they are readable the moment someone opens the file, so the only way to know if your credentials were part of this exposure is to scan your email.

Why This Is Dangerous

A plaintext password sitting next to an email address needs no cracking and no guesswork. Anyone who downloads this file can try that exact password against other services within seconds, and if you have ever reused a password across more than one account, this single leak can unlock several of them at once.

What Was Exposed

• Email Addresses
• Plaintext Password
• URLs

The realistic consequences here include automated credential stuffing against email providers, banking portals, and social media accounts, along with account takeover attempts that succeed simply because a password was never changed. The included URLs tell an attacker exactly which site each password was meant for, removing the guesswork from targeting a specific account.

A combolist like this one is typically compiled from many smaller credential leaks and infections, then bundled together and passed around Telegram channels for anyone to use. Unlike a breach pulled from a single company's servers, a combolist mixes data from countless sources, which is why the same file can affect people who have never even heard of each other.

Find Out If Your Credentials Are Inside

Scan your email to check whether it turns up in this file. If it does, change that password everywhere you have reused it, starting with email and banking logins, and turn on two-factor authentication wherever it is offered.

This applies equally to personal and work email addresses, since combolists frequently mix both.