The Linkedin HITS TEST MAIL ACCESS File Leaked 161 Logins

HEROIC analysts found a file labeled Linkedin HITS TEST MAIL ACCESS uploaded to a Telegram channel. The data itself is dated April 23, 2024, meaning it circulated privately for roughly two years before this posting. It contains 161 records of email addresses, plaintext passwords, and login URLs. The label references LinkedIn and mail access testing, but HEROIC found no evidence in the file itself that it originated from a LinkedIn systems breach, it appears to be a combolist of email credentials that were verified, or 'hit tested,' against mail login pages. Why This Is Dangerous: Because the credentials in this list are marked as verified 'hits,' they are more dangerous than an unverified list of random guesses. Someone has already confirmed that these 161 email and password pairs work, which means an attacker can use them immediately without needing to test each one first. What Was Exposed: - Email addresses - Plaintext passwords - Login URLs Why This Matters: A two-year-old list might seem outdated, but many people do not change their passwords for years, if ever. If any of these 161 accounts still use the same password, or if that password has been reused on other sites, the account is exposed to credential stuffing and takeover today, not just in 2024. How a Combolist Like This Works: A 'hits' file like this one is created by taking a larger list of email and password guesses and running them against real login pages to see which ones succeed. Only the working combinations, the hits, are kept and repackaged into a smaller, higher value file, which is then sold or shared on Telegram because every entry is confirmed to work. Check If You Are Affected: Old leaks can still cause new damage if a password was never changed. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, old and new, so you can find out if you are one of the 161 affected here or in any other breach.