The Mansory 10 Combolist Leak Exposed 1.69 Million Login Pairs

HEROIC analysts identified a combolist file known as Mansory 10 circulating in a Telegram channel on March 15, 2026. The file contains 1,692,243 individual records pairing email addresses with plaintext passwords and the website URLs where those credentials were originally used. Why This Is Dangerous: Every record in this file gives an attacker a working username, a real password, and the exact site the login belongs to. That combination removes the guesswork from an attack. Instead of trying random passwords against random sites, a criminal can go straight to the account these credentials were built for and log in as if they were you. What Was Exposed: The Mansory 10 file contains three data points repeated across nearly 1.7 million records. - Email addresses used as account usernames - Plaintext passwords, stored and shared with no encryption - URLs identifying which website or service each login unlocks Why This Matters: Because passwords in this file are stored in plaintext and matched to specific URLs, they are immediately usable for credential stuffing, the practice of testing stolen logins across banking, email, and shopping sites to find accounts where people reused the same password. Anyone whose email appears in this file faces a real risk of account takeover, and from there, identity theft or financial fraud if the compromised account touches money or personal data. How a Combolist Like Mansory 10 Works: A combolist is simply a large text file of email-or-username and password pairs, often built by combining older breaches, phishing hauls, or malware-stolen data into one list. Criminals prize combolists because they are cheap to produce, easy to share on Telegram, and ready to run through automated login tools the moment they're uploaded. The scale of this one, nearly 1.7 million entries, makes it a high-value target for exactly that kind of automated abuse. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including combolists like Mansory 10. Run a scan to see if your credentials appear in this or any other breach, and change any reused passwords right away.