In late November 2024, HEROIC analysts identified a combolist file circulating on Telegram containing 8,749 records tied to Libero.it, the Italian webmail service, alongside Hotmail-linked accounts. The file paired email addresses with plaintext passwords and the URLs where those credentials were originally used, the classic format criminals use to test stolen logins at scale. Why is this dangerous? Because the passwords in this dump are stored in plaintext, anyone who downloads the file can read them directly, no cracking or decryption required. Paired with the matching email address and the original URL, an attacker has everything needed to log into an account immediately. If you have ever reused a password across multiple sites, a file like this can act as a skeleton key to your email, banking, or social media accounts. What was exposed: email addresses from Libero.it and Hotmail accounts, plaintext passwords, and the URLs linked to each set of credentials. Why this matters: combolists like this one are the raw material for credential stuffing attacks, where automated tools try each email and password pair against banking sites, retailers, and social platforms. Even a relatively small file of 8,749 records can lead to account takeover, financial fraud, and identity theft once the passwords are reused elsewhere. How this combolist was built: a combolist is a compiled text file of combo entries, an email or username paired with a password, usually gathered from older breaches, phishing campaigns, or malware infections and repackaged for resale or free distribution. Telegram has become a popular distribution channel because it lets criminals share large files with open channels quickly and with little accountability. Check if you are affected: you do not need to guess whether your credentials are sitting in a file like this one. HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including combolists like this Libero.it dump, so you can find out in seconds and change any exposed passwords before someone else uses them.