Identity Theft Risk Grows: Misc Combolists Leaked 1.9 Billion Records

HEROIC analysts identified a 2015 dataset known as Misc Combolists that exposed 1,927,529,995 records, making it one of the largest single entries in our breach database. The compromised data consists of email addresses paired with passwords stored in plaintext.

Why This Is Dangerous

Plaintext passwords require no cracking at all. Anyone who obtains this dataset can read the exact password tied to each email address and try it immediately against other accounts. At nearly 2 billion records, this combolist likely combines credentials pulled from many smaller breaches into one massive, ready-to-use list.

What Was Exposed

• Email addresses
• Passwords (stored in plaintext)

Why This Matters

A list of this size is a powerful tool for automated attacks. Because the passwords are already in plaintext, attackers can run them against email providers, banking sites, and shopping accounts immediately, at massive scale, without spending any time or computing power cracking hashes first. If your email and password ever appeared in any of the smaller breaches that likely feed into a list like this, that combination could be sitting inside this file right now.

How a Combolist Like This Comes Together

The name Misc Combolists points to something specific: a combolist, a combined list of email addresses and passwords gathered from many different breaches and compiled into one master file. Combolists are prized by attackers because they let a single automated tool test millions of email and password combinations against many websites at once, without needing to crack a single hash first.

Check If You Are Affected

Given the scale of this dataset, it is worth checking whether your email address shows up in it or in any of the breaches that may feed into it. HEROIC's free breach scanner checks a database of more than 400 billion leaked records, so you can see instantly if your email address turns up and update any passwords you may still be reusing.