PayPal-Labeled Combolist Exposes 2 Million US Login Credentials

A combolist self-labeled "2.2KK USA Paypal UHQ Base" was uploaded to Telegram in April 2023, exposing 2,017,531 records of email addresses, plaintext passwords, and the URLs each login was tied to. The name indicates the uploader marketed this batch as high-quality credentials associated with PayPal accounts, though HEROIC cannot confirm PayPal itself was breached; the label reflects how the criminal seller chose to describe the file.

Why This Is Dangerous

PayPal-labeled combolists are prized by criminals because a working login can provide direct access to linked bank accounts and cards, not just the payment platform itself. With more than 2 million records in this batch, an attacker has enormous scale to work with, even if only a fraction of the logins still function.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters

Anyone whose credentials appear in this file faces a heightened risk of financial fraud if the account is tied to a real payment platform login, and reused passwords extend that risk to other accounts through credential stuffing. The sheer size of this dump means automated attacks against it can run at scale.

How a "UHQ" Combolist Like This Gets Labeled

Sellers on Telegram often label combolists by the service they claim the credentials unlock, such as "Paypal," to help buyers who specialize in a particular type of fraud find relevant data quickly. The "UHQ" tag signals the list has been filtered and checked, while "2.2KK" is shorthand for roughly 2.2 million records, close to the 2,017,531 actually confirmed in this file.

Check If You Are Affected

Search HEROIC's free breach scanner, which checks your email against more than 400 billion leaked records, and if you find a match, change your password and review your PayPal and linked bank activity for anything unfamiliar.