More Than Half a Million Accounts Leaked in the ‘Brazil 14’ Dump

What HEROIC Analysts Found On 18 February 2023, a combolist labeled Brazil 14 was uploaded to Telegram, and HEROIC analysts have since confirmed it contains 550,721 records. Each entry pairs an email address with a plaintext password and a URL tied to that login, making this one of the larger Telegram dumps HEROIC has reviewed. Why This Is Dangerous A list of more than half a million working logins gives an attacker enormous reach with almost no effort. Because the passwords are stored in plaintext, there is nothing standing between the data and someone who wants to use it, just a file to download and run against other sites. What Was Exposed 550,721 email addresses Plaintext passwords for each account URLs tied to each login Why This Matters Files of this size are built for automated credential stuffing attacks, where bots test each stolen email and password pair against banking, email, and shopping sites at scale. With over half a million accounts involved, even a small success rate translates into thousands of compromised accounts, opening the door to identity theft and financial fraud. How the Brazil 14 Combolist Was Assembled Large numbered combolists like Brazil 14 usually represent one release in an ongoing series, with each version compiled from older breaches, phishing pages, and malware-infected devices. The numbering suggests the uploader has released multiple batches over time, gradually assembling millions of credentials for trade on Telegram. Check If You Are Affected With more than half a million records in this leak, checking your own exposure only takes a moment. HEROIC's free breach scanner searches over 400 billion leaked records to tell you instantly if your email and password appear here, so you can secure your accounts before someone else uses them.