The Ninho Private Mix Leak Exposed 690 US-Based Accounts

In July 2026, HEROIC analysts identified a combolist titled Ninho Private Mix shared by a Telegram user. The file contained 690 records, each combining an email address, a plaintext password, and the URL the credentials are tied to, associated with United States based accounts. Why the Ninho Private Mix leak targets US accounts: marketed as a private mix, this file was compiled and offered on a smaller, more exclusive basis rather than mass-distributed, but it still exposes 690 real email and password combinations tied to United States accounts. Because it's private, sold or shared within a smaller circle, the people who obtain it may use these credentials more carefully and deliberately rather than in a wide, indiscriminate attack. What was exposed in the Ninho Private Mix: email addresses, plaintext passwords, and URLs tied to each account. Why a private leak still poses real risk: even at 690 records, a private combolist can be just as dangerous as a larger public one, since the smaller circle trading it may take more care testing and using each credential. Anyone in this file faces the same risks as any other leak, credential stuffing, account takeover, identity theft, and financial fraud, especially if the exposed password is reused elsewhere. How private combolists like this circulate: unlike free, mass-shared logs, a file labeled private mix is typically traded within smaller, trusted Telegram groups or sold directly rather than posted publicly, which can mean the credentials inside stay usable for longer since they're not immediately flagged or reported. Check if you are affected: if you're based in the United States and want to know whether your email is part of the Ninho Private Mix leak or any other exposure, HEROIC's free breach scanner checks your address against more than 400 billion leaked records instantly.