HEROIC Analysts Found a 9,991-Record USA Test 2 Combolist

HEROIC analysts found a combolist labeled "usa test 2 uploaded by a Telegram User" while monitoring dark web and Telegram sources on June 6, 2026. The file contains 9,991 records, each combining an email address with a plaintext password and a linked URL.

Why the USA Test 2 Combolist Is Dangerous

Every one of the 9,991 records in this file pairs a working login with the exact site it belongs to, and because the passwords are stored in plaintext, there is no encryption standing between the data and anyone who wants to use it. That combination turns the file into a ready-made attack tool the moment it lands in the wrong hands.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to the accounts

Why This Matters

Combolists at this scale are a favorite tool for credential stuffing, automated attempts to reuse each email and password pair across banking, shopping, and social media accounts. Anyone whose information appears in this file is at risk of having that specific account compromised, and if the password was reused anywhere else, the exposure can spread into account takeover, identity theft, and financial fraud.

How Combolists Work

A combolist is a compiled file of login credentials, often labeled with generic or placeholder-style names like "usa test 2" as sellers batch and test new lists before wider distribution. It was uploaded to Telegram, a common channel for sharing these files. Because the passwords were already stored in plaintext, no cracking or decryption stood between the upload and its use.

Check If You Are Affected

Even lists with unassuming names like this one can contain real, working credentials. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists, stealer logs, and database dumps, so you can find out quickly and change any password that is still exposed.