lines_Devices Leak: What Passwords Were Exposed, Who Should Check

HEROIC analysts logged 505 exposed records in the lines_Devices file, dated January 2026, each one pairing an email address with a plaintext password and the web address it unlocks. That number, 505 separate logins, is now circulating on Telegram for anyone to download. The only way to know if you're affected is to scan your email.

505 Passwords, Zero Encryption

None of the 505 passwords in this file need to be cracked. They were stored and shared exactly as typed, meaning the only barrier between this file and an active login is whether someone bothers to try it.

The Login Details Behind Each of 505 Entries

• Email Addresses: the starting point for phishing messages, spam, and looking up what else that address is tied to.
• Plaintext Password: visible exactly as typed, meaning anyone holding the file can try it on other accounts right away.
• URLs: tells an attacker precisely where to try the credentials, skipping any guesswork about which account they open.

505 Working Pairs, Already Verified

The presence of a working URL next to every password suggests these pairs were checked before release. That verification step is what separates a random list from a genuinely dangerous one.

How a List Like This Gets Tested and Shared

Combolists like this one typically start as raw, unverified credentials, get filtered down to the pairs that still log in, and are then shared or sold once that testing is complete.

Is Your Login One of the 505 Logged Here?

Start by taking a moment to scan your email and see whether this file, or any other, included your address. If it did, change that password on every account where it has been reused, and use a unique password for every account going forward. This applies whether the address involved is a personal inbox or a work email, since either one can open the door to the other.