Indonesia 3 Combolist: 70,219 Email and Password Pairs Leaked Online

HEROIC analysts found a combolist titled Indonesia 3 uploaded to a Telegram channel, dated May 7, 2023. The file contains 70,219 records, each combining an email address with a plaintext password and the URL where that login was used. Why This Is Dangerous: With more than 70,000 working email and password pairs in one file, attackers have enough volume to run large-scale automated login attempts across multiple websites, hoping to find accounts where the same password still works. What Was Exposed: Every record in the Indonesia 3 file contains the same three data points. - Email addresses - Plaintext passwords - URLs identifying each login's associated site Why This Matters: A file of over 70,000 records is large enough to fuel serious credential stuffing campaigns. Anyone whose email is in this list faces a real risk of account takeover, particularly if they reused their password across email, banking, or shopping accounts. How a Combolist Like This Works: Files like Indonesia 3 are typically assembled by combining data from multiple smaller breaches or stealer infections tied to a particular region, then packaged and distributed through Telegram channels for free or for sale. The regional focus makes lists like this attractive to attackers targeting a specific country's users. Check If You Are Affected: Search your email using HEROIC's free breach scanner, covering more than 400 billion leaked records, to see if you appear in the Indonesia 3 combolist or any other breach.