Account Takeover Risk Grows as Netflix Combolist Leaks 23,323 Logins

What HEROIC Analysts Found

In May 2025, HEROIC's threat intelligence team identified a combolist targeting Netflix accounts after it was uploaded to Telegram by an individual user. The file contained 23,323 records pairing email addresses with plaintext passwords, along with the Netflix login URLs they were used against.

Why This Is Dangerous

This is not a case of Netflix's own systems being hacked. Instead, someone compiled working email and password combinations, likely gathered from other breaches or stealer malware, and packaged them specifically for logging into Netflix accounts. Because the passwords are stored in plaintext, anyone who gets this file can log in immediately, no cracking required.

What Was Exposed

• Email addresses
• Plaintext passwords
• Netflix account login URLs

Why This Matters

A streaming account might feel low stakes, but the real danger is what it reveals about you elsewhere. If your Netflix password is the same one you use for email or banking, this list gives an attacker a direct path into those accounts too through credential stuffing. Beyond hijacking your subscription, criminals can use confirmed working logins to test the same credentials across dozens of other sites, leading to account takeover, identity theft, and financial fraud.

How Combolists Work

A combolist is a simple text file pairing usernames or emails with passwords, often labeled by the service they target, in this case Netflix. These lists are usually assembled from older breaches, phishing hauls, or malware-infected devices, then verified and sold or shared for free on Telegram channels. Their value to criminals comes from being pre-checked, meaning many of the logins inside are confirmed to still work.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion breached records, including combolists like this one. If you find a match, change your Netflix password and any other account sharing it right away.