100,609 Passwords From the ‘Gift’ Combolist Just Leaked Online

HEROIC analysts discovered a combolist simply labeled "Gift" that a Telegram user uploaded on July 3, 2026. The file contains 100,609 records, each pairing an email address with a plaintext password and the URL the credentials unlock, a sizeable batch shared under an unassuming name. Why this is dangerous: with over 100,000 records in plaintext, this file gives an attacker an enormous head start, no cracking, no guessing, just direct access to working logins the moment the file is opened. The casual name "Gift" suggests it was shared freely rather than sold, meaning it could circulate widely and quickly among a broad range of low-effort attackers. What was exposed: the dataset includes email addresses, plaintext passwords, and the URLs of the accounts each pair belongs to, giving anyone who downloads the file a working login for all 100,609 records. Why this matters: a batch this large is exactly what powers automated credential stuffing attacks, where bots test tens of thousands of email and password combinations against banking sites, email providers, and social media platforms in a matter of hours. Since so many people reuse the same password across multiple accounts, a single match found in this file can escalate into account takeover, identity theft, or financial fraud well beyond the original account. How this combolist was likely built: large combolists like this one are usually assembled from a mix of older breaches, stealer malware logs, and phishing hauls, merged together and given a simple, often lighthearted name before being shared or sold on Telegram. Naming a file "Gift" typically signals that the uploader is giving it away for free, which tends to spread the data faster and wider than a combolist sold for a price. Check if you are affected: with more than 100,000 records involved, there is a real chance your email address is among them. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, giving you an instant answer so you can change any exposed passwords before someone else uses them.