Everyday Email Users Caught in the 1,780-Record Good_Mails Leak

HEROIC analysts flagged a small combolist named "Good_Mails" that a Telegram user uploaded on September 26, 2024. The file contains 1,780 records, each pairing an email address with a plaintext password and the URL of the site the credentials belong to. While the record count is modest compared to major breaches, every entry represents a working login that a criminal can use right now. Why this is dangerous: because the passwords are stored in plaintext and each record includes the exact URL the credentials belong to, an attacker does not need any special skill or tool to use this data. They can simply open the file, pick a target, and attempt to log in. A batch of 1,780 records is small enough that a single attacker working alone could realistically test every entry by hand in a short amount of time. What was exposed: the file contains email addresses, plaintext passwords, and the URLs tied to each login, giving attackers both the credentials and the destination to use them against. Why this matters: password reuse means one exposed login can open the door to other accounts belonging to the same person, including email, banking, and social media. Criminals commonly use small combolists like this one for credential stuffing, testing stolen usernames and passwords against a wide range of websites until one works. Once an attacker gets into even one account, they can pivot to reset passwords elsewhere, commit identity theft, or attempt financial fraud. How this combolist was built: a combolist is a compiled file of username, password, and sometimes URL combinations gathered from previous breaches, stealer malware, or phishing campaigns and repackaged for resale or free distribution. Small combolists like this 1,780-record file are common on Telegram, where users trade and give away batches of credentials, often scraped or filtered from larger breach dumps into more narrowly themed lists. Check if you are affected: if you have used an email address for online accounts in the United States, it is worth confirming your credentials were not part of this leak. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can find out quickly and update any exposed passwords before they are used against you.