One Telegram Upload, 32.6 Million Records: The TXT_ALIENS Combolist

HEROIC analysts identified a combolist called TXT_ALIENS - 1632 that a Telegram user uploaded on May 8, 2026. This is one of the largest single files HEROIC has tracked in this batch, containing 32,615,330 records, each pairing an email address with a plaintext password and the URL that login was used on. Why This Is Dangerous: At this scale, the danger is not just individual accounts, it is the sheer volume of working logins now available to attackers. Each of the 32,615,330 records hands over a complete credential set, the email, the exact password, and the site it opens, ready to be tested immediately. What Was Exposed: - Email addresses - Plaintext passwords - URLs tied to each credential pair Why This Matters: A file of this size is built for large-scale, automated credential stuffing, where attackers use bots to test millions of login pairs against banking sites, email providers, and social media platforms in a short window. Anyone whose data appears here faces a meaningfully higher risk of account takeover, identity theft, or financial fraud, especially if a password has been reused across multiple sites. How a Large Combolist Like This Works: Files named with "TXT" or numbered like this one are typically compiled from multiple smaller sources, other breaches, stealer malware logs, and phishing hauls, merged together into one master list and organized by domain. The size of these "ALIENS" style files makes them a popular resource for large-scale automated attacks on Telegram and other underground marketplaces. Check If You Are Affected: With more than 32 million records in a single file, the odds that your information is included are real. HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including this TXT_ALIENS leak. Run a free scan now to find out.