One File. 17,155 Logins. The 20K Shopping Basse Leak Is Real.

HEROIC analysts found a combolist titled 20K Shopping Basse posted to a Telegram channel on February 11, 2023. The file contains 17,155 records pairing email addresses with plaintext passwords, along with URLs pointing to the shopping and retail sites where each login pair is used. Despite the "20K" in its name, the verified count in this file is 17,155 records.

Why the 20K Shopping Basse Leak Is Dangerous

Every password in this file is stored as plaintext and tied to a specific shopping site URL, which means an attacker does not need to guess where a stolen login works. They can go straight to the listed site and attempt to log in, check stored payment methods, or place fraudulent orders using saved account details.

What Was Exposed in This Combolist

• Email addresses
• Plaintext passwords
• URLs linked to each set of shopping account login credentials

Why This Matters for the 17,155 Accounts Involved

Shopping accounts often have saved credit cards, stored addresses, and order histories attached to them, making them a direct path to financial fraud. If any of these 17,155 people reused their email and password on other sites, attackers can also use credential stuffing to break into banking, email, or social media accounts tied to the same login.

How Shopping Site Combolist Leaks Like This One Work

A combolist like 20K Shopping Basse is built by collecting login credentials, often from phishing pages, malware infections, or older breaches, then organizing them by the specific website they belong to. Grouping by site makes the list more valuable to buyers, since it lets an attacker target shopping platforms directly instead of guessing which service a stolen password might unlock.

Check If You Are Affected by the 20K Shopping Basse Leak

HEROIC maintains a database of more than 400 billion breached and leaked records, including combolists like this one. Use HEROIC's free breach scanner to check whether your email address appears in this 17,155-record leak or any other exposure, and find out which passwords you should change first.