HEROIC Analysts Found 102 Verizon Account Logins on Telegram

HEROIC analysts identified a combolist file named VERIZON HITS uploaded to a Telegram channel in August 2025. In criminal slang, hits refers to credentials that have been tested and confirmed to still work, meaning every entry in this file is a live Verizon account login rather than an untested guess. The file contains 102 records pairing email addresses with plaintext passwords and the URLs those accounts connect to. This appears to be a list of customer account credentials rather than evidence of a breach inside Verizon's own systems. Why This Is Dangerous: Because every login in this file has already been confirmed to work, an attacker does not need to guess or test anything. They can log in immediately and start making changes to the account, viewing billing details, or attempting to port the phone number to a new device. What Was Exposed: - Email addresses - Plaintext passwords - URLs tied to the Verizon accounts Why This Matters: A confirmed-working telecom account login is especially valuable to attackers because phone accounts are often used to intercept two-factor authentication codes sent by text message, a technique known as SIM swapping. If an attacker gains control of your Verizon account, they could potentially redirect your phone number and use it to break into your email, banking, or social media accounts that rely on text message verification. How a Hits List Like This Works: Attackers build hits lists by taking large batches of leaked or guessed credentials and testing each one against the target's real login page, keeping only the pairs that successfully log in. That verification step is what separates a hits list from an ordinary combolist and makes it far more valuable and dangerous, since every credential inside is already known to work. Check If You Are Affected: Run a free scan against HEROIC's database of more than 400 billion breached records to see if your email address appears in this leak or any other. If you have a Verizon account, change your password immediately, add a PIN or passcode to prevent unauthorized SIM changes, and avoid relying on text messages as your only form of two-factor authentication.