Inside the Farmadelivery BR Combolist: 1.1M Passwords Exposed

HEROIC analysts identified a combolist tied to "farmadelivery BR" circulating on Telegram, uploaded on 18-Aug-2023. The file contained 1,145,355 records combining email addresses, plaintext passwords, and the URLs of the login pages those credentials belong to.

Why Plaintext Passwords Paired With Login URLs Is a Worst-Case Combination

Because the passwords in this combolist are stored in plaintext, anyone who obtains the file can read them immediately, no cracking required. Since each record also lists the URL of the site the credential belongs to, an attacker can move straight from the file to attempting a login, with no guesswork involved.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each credential to its source login page

Why the Farmadelivery BR Combolist Puts More Than One Account at Risk

Combolists exist for one purpose: credential stuffing. Automated tools take each email and password pair from a file like this and test it against banking, email, and shopping sites. If any of the 1.14 million people in this file reused their farmadelivery BR password elsewhere, those other accounts are now exposed to account takeover, financial fraud, and identity theft.

How This Combolist Was Assembled and Shared

A combolist is a compiled file of stolen login credentials, usually gathered from past breaches, phishing pages, or malware and bundled together for resale or free distribution. Telegram channels dedicated to sharing leaked data make it easy for a file like this to reach thousands of people quickly, long after the original exposure took place.

Check If Your Email Appears in the Farmadelivery BR Leak

With over 1.1 million records in this file, checking your exposure takes only seconds. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including this combolist, so you can find out immediately if your credentials need to be changed.