PayPal Combolist Leak: 20,333 Records, More Than a Sold-Out Arena

In February 2023, HEROIC analysts found a combolist file titled 20k UHQ PayPal Combolist Target being shared by a Telegram user. The file bundled 20,333 records, each pairing an email address with a plaintext password and a URL, compiled specifically to target PayPal login pages. Why this PayPal-targeted combolist is dangerous: a combolist built around a single service, in this case PayPal, is designed for one purpose, automated login attempts against that exact platform. Attackers load lists like this into bots that try each email and password pair against PayPal's sign-in page in seconds. Because PayPal accounts are tied directly to bank accounts and cards, a successful match can mean an attacker walks straight into someone's money. What was exposed in the 20k UHQ PayPal combolist: email addresses used as PayPal login usernames, plaintext passwords that are unencrypted and ready to use, and URLs identifying the login target for each pair. Why this matters for PayPal users: with 20,333 credential pairs aimed specifically at one payment platform, this list is built for credential stuffing at scale. Anyone whose email and password combination appears here is at risk of account takeover, unauthorized transfers, and financial fraud, especially if that same password is reused on other financial or shopping accounts. How combolists like this are built: a combolist is a compiled collection of email and password pairs, usually pulled from older, unrelated data breaches and stitched together into one file. Criminals then label and sort combolists by target, in this case PayPal, so the list can be fed directly into automated login tools. The UHQ, short for ultra high quality, in the file name signals that whoever compiled it has already filtered out dead or invalid logins, making the remaining pairs more likely to work. Check if you are affected: if you use PayPal or reuse passwords across financial accounts, it's worth checking whether your email appears in this leak or others like it. HEROIC's free breach scanner searches a database of more than 400 billion exposed records and tells you immediately if your information has surfaced.