The ‘good’ Combolist Could Unlock Your Email and Bank Accounts

In November 2025, HEROIC analysts found a combolist file named good circulating on Telegram. The file contained 954 records pairing email addresses with plaintext passwords, along with the URLs those credentials were used on.

Why the 'good' Combolist Is Dangerous

A single leaked email and password pair rarely stays contained to one account. If someone in this file reused that password for their email, banking app, or social media, the same login could open all of those doors, one after another, once an attacker starts trying it.

What Was Exposed in the 'good' Leak

• Email addresses
• Plaintext passwords
• URLs linked to each set of credentials

Why This Matters for the 954 People Affected

This is exactly how a small leak turns into a bigger problem. An attacker who gets into an email account using a reused password can reset the passwords for banking, shopping, and social media accounts linked to that inbox, turning one exposed credential into a chain of compromised accounts, financial fraud, and identity theft.

How Combolist Leaks Like 'good' Work

A combolist is a plain text file pairing usernames or emails with passwords, usually gathered from older breaches, phishing pages, or malware infections and repackaged for resale or free distribution. Telegram channels have become a common place for these files to surface, often under short, forgettable names like good, which makes them easy to overlook even though the credentials inside are real and usable.

Check If You Are Affected

If you think your email address could be part of the 'good' leak or any other combolist, HEROIC's free breach scanner checks your information against a database of more than 400 billion exposed records. Run a scan now to see whether your credentials have appeared in this leak, and change any reused passwords right away.