How the laservice.it Combolist Led to 1,200 Stolen Logins

A Small Decrypted Combolist Tied to laservice.it Surfaced on Telegram

On 20 August 2023, HEROIC analysts identified a combolist labeled "laservice.it_7.685_decrypted," uploaded to Telegram by an individual user. The file name ties the data to laservice.it and indicates the passwords have already been converted into readable plaintext. The list is small compared to many combolists HEROIC tracks, containing 1,200 records, each pairing an email address with a plaintext password and the URL of the login page those credentials were meant to access.

Why This Is Dangerous

Size does not determine risk here. Every one of these 1,200 passwords is stored in plaintext, meaning an attacker can read it directly next to the matching email address and site, with no cracking needed. For the individuals in this smaller list, the danger is just as real as it would be in a much larger breach, their exact login credentials are sitting in a file anyone can download.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

Small combolists are often overlooked, but attackers do not discriminate by file size. These credentials can be fed into credential stuffing tools that test each email and password pair against other sites: email providers, banks, and online retailers. Anyone who reused this password elsewhere faces the same risk of account takeover, identity theft, and financial fraud as someone caught up in a breach involving millions of records.

How This laservice.it Combolist Was Decrypted and Leaked

A "decrypted" combolist starts as a set of credentials that were originally hashed or encrypted, then reversed back into plain, readable text by someone using cracking tools or prior unauthorized access. Once decrypted, the list is formatted as email, password, and site URL and circulated through Telegram channels where individuals trade or give away stolen credential sets, regardless of how small the batch is.

Check If You Are Affected

If you have ever used laservice.it or reused a password across accounts, it only takes a minute to check. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including combolists like this one, so you can confirm your exposure and change any at-risk passwords right away.