The live.de Combolist Leak Exposed 560 Email and Password Pairs

HEROIC analysts found a combolist tied to live.de uploaded to a Telegram channel on 13 December 2024. The file contained 560 records pairing live.de email addresses with plaintext passwords, along with associated URLs for the accounts involved.

Why This Is Dangerous

Because the passwords in this combolist are stored in plaintext, they can be read and used the moment someone opens the file, with no cracking required. Anyone who gets hold of this list can attempt to log directly into any of the 560 live.de email accounts included in it.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

Email accounts are often the key to resetting passwords on other services, so a compromised live.de inbox can quickly turn into a much bigger problem. Attackers use combolists like this one to run credential stuffing attacks, trying the same email and password combination on banking, shopping, and social media sites. If any of these 560 people reused their live.de password elsewhere, those accounts are exposed to takeover as well.

How Combolists Work

A combolist pairs email addresses or usernames with matching passwords in a plain text file, one record per line. Rather than being freshly harvested from an infected device, combolists tied to a specific webmail provider like live.de are often compiled from earlier leaks or scraped data, then repackaged and shared on Telegram channels and dark web forums. Their simple structure makes them quick for criminals to load into automated login tools.

Check If You Are Affected

If you use a live.de email address or have reused a password across multiple accounts, it is worth checking your exposure now. HEROIC's free breach scanner searches more than 400 billion leaked records, including combolists like this one, so you can find out quickly and secure any accounts that may be at risk.