Months-Old Passwords Resurface in the lines_amazon Leak

If you set up an Amazon-linked login back in January 2026 and never thought about it again, the lines_amazon combolist is a reason to think about it now. Uploaded to Telegram that same month but only recently logged by HEROIC analysts, the file pairs 471,521 email addresses with plaintext passwords and the URLs those logins were used on. Scanning your email is the only way to know if yours is one of them.

Why Older Credentials Still Surface Months Later

A combolist doesn't always spread the moment it's created. Files like this one often circulate in smaller private channels first before a broader copy shows up where analysts can catch it, which means credentials from months back can still be making their first real rounds right now.

What Was Exposed

• Email Addresses: ties each password to the exact account it unlocked.
• Plaintext Password: readable in full, with no cracking needed before use.
• URLs: records the shopping login the credential pair was tied to.

Why This Matters

Time passing doesn't mean the password was ever changed. If you haven't updated the login tied to this file since January, it's likely still sitting there exactly as captured, and just as useful to anyone trying it today as it would have been the day it was taken.

How This Breach Type Works

lines_amazon wasn't pulled from one retailer's breach. It was built by comparing credentials already leaked elsewhere and keeping the pairs where the same password repeated, then labeling the resulting batch after the shopping login it was last confirmed against.

Is Your Amazon-Linked Login in lines_amazon?

Run the scan your email tool above to check. If a match turns up, change that password now, along with any other account still using it, even if the login has sat untouched since January. This matters whether the email involved is personal or one you use for work.