248,935 Logins for globalcatalog.com_DB Exposed in a Combolist Leak

HEROIC analysts uncovered a combolist containing 248,935 logins for globalcatalog.com, shared on Telegram in August 2026 and built from email addresses, plaintext passwords, and the URLs each one unlocks. Almost a quarter million working logins is a large enough batch to make this file attractive to anyone running automated login attempts. Scan your email to check if your address is among them.

A set this size is dangerous mainly because of scale and speed. Automated tools can run through 248,935 username and password pairs in a short amount of time, and because the passwords are stored in plaintext, no cracking is needed before an attempt is made. Any account that reused one of these passwords elsewhere is exposed the moment the list starts being used.

What the globalcatalog.com_DB File Holds

• Email addresses: identify the account each login belongs to.
• Plaintext password: ready to use without cracking.
• URLs: point to the exact page each login was collected from.

What Nearly a Quarter Million Logins Enables

At this scale, an attacker does not need every password to work, even a small success rate against 248,935 attempts yields thousands of working accounts. From there, reused passwords let an attacker pivot into email, shopping, or other services tied to the same address. A compromised email account in particular can be used to reset passwords elsewhere, multiplying the damage from a single leaked login.

How a Combolist of This Size Comes Together

A combolist like this is assembled by pulling email and password pairs from many smaller sources and sorting them so they work against one target, in this case globalcatalog.com. It does not necessarily mean globalcatalog.com's own systems were broken into, it means logins that happen to work there were gathered from elsewhere and packaged for reuse. Files like this circulate widely once built, since they can be tested against the named site in bulk.

Responding to the globalcatalog.com_DB Leak

Scan your email to see whether your address is part of this 248,935 record file.

Change the password on globalcatalog.com and on any other account using the same password, since reuse is the main risk with a file like this. Check both personal and work email addresses, since either can turn up in a combolist this size.