Online Shoppers Targeted: whatnot_login_pass Leaked 1,727 Passwords

What HEROIC Analysts Found

HEROIC analysts identified a combolist called whatnot_login_pass, leaked on July 3, 2025 and later uploaded by a Telegram user. The file contains 1,727 records, each pairing an email address with a plaintext password and the URL of the account it was taken from.

Why This Hits Online Marketplace Shoppers Hardest

The name of this file points to accounts on an online marketplace platform, the kind of account that often has a saved payment method or shipping address attached. If an attacker logs in using one of these 1,727 credential pairs, they may be able to place orders, change shipping details, or access saved payment information without ever needing to steal a credit card number directly.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each credential pair to its marketplace login

Why This Matters

Shopping accounts are an easy target because people often reuse the same password across marketplaces, email, and banking. A single exposed login from whatnot_login_pass can lead to credential stuffing on other sites, unauthorized purchases, and account takeover, especially since the leak has been available since mid-2025.

How Combolists Work

A combolist gathers email or username and password pairs, often from stealer logs, prior breaches, or phishing, and organizes them around a theme, in this case a specific online marketplace, so they can be targeted more effectively. That focus is what makes whatnot_login_pass more useful to criminals than a random, unsorted dump.

Check If You Are Affected

If you shop on online marketplaces, it is worth checking your email now. HEROIC's free breach scanner checks your address against more than 400 billion exposed records, including targeted combolists like whatnot_login_pass, and tells you immediately if a password change is needed.