One Small File: The live.com.au Combolist Exposed 622 Credentials

HEROIC's threat intelligence analysts identified a combolist file titled "live.com.au" circulating on Telegram in December 2024. The file contained 622 records, including email addresses and plaintext passwords, tied to the live.com.au email domain. HEROIC added it to its breach database so affected users can check their exposure.

Why the live.com.au Leak Is Dangerous

The data in this file is not encrypted or hashed. It is stored as plain, readable text, which means anyone who downloads the live.com.au file can immediately see a real email address next to its matching password, with no cracking or decryption required. That makes it usable the moment it is downloaded.

Because the passwords are plaintext, an attacker does not need any special skill to abuse them. They can simply load the 622 email and password pairs into automated software and start testing them against email providers, banking sites, and social media platforms within minutes.

What Was Exposed in the live.com.au Leak

• Email addresses
• Plaintext passwords
• Associated login URLs

Together, these three pieces of data give an attacker everything needed to attempt a direct login: who the account belongs to, what the password is, and where to use it.

Why the live.com.au Leak Matters for Your Accounts

Most people reuse the same password, or a close variation of it, across multiple accounts. If your email and password appear in the live.com.au file, criminals can attempt to log into your email, banking, or shopping accounts using that exact combination, a tactic called credential stuffing.

A successful login can lead to account takeover, where an attacker locks you out and uses the account for fraud, spam, or further scams against your contacts. Stolen email access in particular is dangerous because email is often used to reset passwords on every other account you own, turning one leaked password into a much larger identity theft problem.

How the live.com.au Combolist Was Likely Built

A combolist is not usually the product of a single hack. Instead, criminals pull email and password pairs from older breaches, stealer logs, and phishing pages, then merge them into one plain text file formatted as "email:password" or "username:password:URL." The live.com.au file follows that same pattern.

Once compiled, combolists are traded or given away on Telegram channels and dark web forums, where other criminals load them into automated tools. Those tools test each pair against hundreds of popular websites in minutes, a technique known as credential stuffing. The people behind the live.com.au file may never have breached anything directly. They simply repackaged stolen data and put it back into circulation.

Check If You Are Affected by the live.com.au Leak

If you think your email address could be part of the live.com.au file, or any of the 622 records in this leak, you can find out for free. HEROIC's breach scanner checks your email against a database of more than 400 billion leaked records, including this file, so you can see exactly what has been exposed.

If you are affected, change the password on any account tied to that email right away, and avoid reusing it anywhere else. Running a free scan takes less than a minute and can tell you whether this leak, or any other, already put your accounts at risk.