Gaming Base Combolist Leak: 199,787 Accounts at Chained Risk

Gaming Base Combolist: 199,787 Accounts Exposed

HEROIC analysts identified a combolist known as "200k Userpass Gaming Base," uploaded to a Telegram channel and dated to January 2023. The file contains 199,787 records pairing email addresses with plaintext passwords, along with the URLs of the gaming platforms those accounts belonged to. Because the list was assembled specifically around gaming logins, it gives attackers a focused, ready-made target list rather than a scattered mix of unrelated accounts.

Why This Is a Chained Risk

Gaming accounts rarely exist in isolation. Many gamers link their accounts to email addresses that are also used for banking alerts, shopping platforms, or password recovery on other services. If a gaming password was reused elsewhere, this single leak can chain outward, letting an attacker who breaks into a gaming account pivot to email, financial, or shopping accounts using the same or similar credentials. In-game items, wallets, and linked payment methods also give attackers direct paths to financial loss, not just inconvenience.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated gaming accounts

Why This Matters

Because these passwords are stored in plaintext, no cracking or decryption is needed before they can be used. Attackers commonly run large combolists like this one through automated credential stuffing tools, testing each pair against gaming platforms first, then against email providers, banking sites, and shopping accounts where the same login might have been reused. The larger the list, the more efficient this process becomes, and at nearly 200,000 records, this file gives attackers substantial reach.

How a Combolist Attack Works

A combolist is a compiled file of email or username and password pairs, typically gathered from older breaches, malware infections, or previous leaks and organized around a common theme, in this case, gaming accounts. Once distributed on channels like Telegram, other criminals download the file and load it into automated tools that attempt logins across many sites at once. Because this list has been circulating since at least January 2023, the exposure has had time to spread well beyond its original source.

Check If You Are Affected

If you have gaming accounts that may be tied to this leak, it is worth checking now rather than waiting for signs of trouble. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records and will tell you immediately if you were exposed. If you find a match, change that password everywhere it was reused and consider enabling two-factor authentication on your gaming and email accounts.