One Telegram Upload. One Combolist. 9,163,940 Yahoo-Tagged Logins.

HEROIC analysts tracked a file titled "COMBOLIST 10M APAN YAHOO FRESH 100" uploaded to Telegram in June 2026. The filename advertises 10 million records, but the verified count in the actual file is 9,163,940 email addresses paired with plaintext passwords and associated login URLs. We're reporting the confirmed figure rather than the marketing number in the file's name. Why This Is Dangerous: With nearly 9.2 million plaintext email and password pairs in one file, an attacker doesn't need any special skill to use it. The passwords are already in readable form, ready to be tried against other accounts the moment someone downloads the file. What Was Exposed: The dataset contains email addresses, plaintext passwords, and the URLs of the accounts those credentials were tied to. The "Yahoo" tag in the filename suggests a large share of the addresses are Yahoo accounts, which are frequently used as a recovery email for other services. Why This Matters: A leaked email inbox is often the master key to someone's entire online life, since it can be used to reset passwords on banking, shopping, and social media accounts. At this scale, automated credential stuffing tools can test all 9.1 million pairs against thousands of websites in a matter of hours, which is exactly why breaches of this size lead to waves of account takeovers. How a Combolist Leak Like This Works: A combolist compiles login credentials from many separate sources, old breaches, phishing kits, and malware logs, into one large file that's easy to search and reuse. Files labeled "fresh" are typically recompiled recently to remove dead or already-used logins, making them more dangerous because the credentials inside are more likely to still work. Check If You Are Affected: If you have or have ever had a Yahoo account, or you reuse passwords across services, checking your exposure now matters. HEROIC's free breach scanner searches more than 400 billion leaked records, including large combolists like this one, and shows you instantly whether your credentials are exposed.