Inside the MOON LIGHT PRIVATE 25 Dump: How 497,491 Logins Leaked

In October 2025, HEROIC analysts identified a combolist labeled MOON LIGHT PRIVATE 25 uploaded to Telegram by an anonymous user. The file contains 497,491 records pairing email addresses and usernames with plaintext passwords, along with the website URLs those credentials belong to.

Why the MOON LIGHT PRIVATE 25 Dump Is Dangerous

Because every password in this file sits in plaintext, an attacker doesn't need to crack anything, they simply copy the email and password pair and try it on the listed site or anywhere else the victim might have an account. That immediacy is what makes combolists like this one so widely traded.

What Was Exposed in the MOON LIGHT PRIVATE 25 Dump

• Email addresses and usernames
• Plaintext passwords
• Associated website URLs

Why This Matters for 497,491 Accounts

Almost half a million exposed logins is more than enough to power large-scale credential stuffing campaigns targeting banks, email providers, and online retailers. Anyone in this file who reused a password anywhere else faces a real chance of account takeover, unauthorized charges, or identity theft.

Inside the MOON LIGHT PRIVATE 25 Dump: How 497,491 Logins Leaked

Combolists like this one are built by merging login "combos," an email or username matched with a password, pulled from older breaches, phishing kits, and malware infections into a single file. No hacking skill is required to assemble or use one, which is why 497,491 credentials could be compiled and uploaded to Telegram by a single anonymous user.

Check If You Are Affected

Don't wait to find out whether your credentials are part of this leak. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including this dump, so you can change any exposed passwords right away.