The ‘PRIVATE 65’ Dump Contains Exactly 3,037 Email and Password Pairs

In February 2026, HEROIC analysts identified a combolist titled 'PRIVATE 65' uploaded by a Telegram user. The file contained exactly 3,037 records pairing email addresses with plaintext passwords, along with the URLs each login was tied to, with accounts traced primarily to the United States.

Why the PRIVATE 65 Leak Is Dangerous

Labeling a file 'private' typically signals that it was meant to be sold or shared quietly before wider release, which often means the credentials inside are less likely to have already been changed. Because the passwords are stored in plaintext and matched to specific URLs, an attacker can use these 3,037 records immediately without any additional work.

What the PRIVATE 65 Leak Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each account

Why This Matters

With 3,037 credential pairs now public, this leak gives attackers a solid list for credential stuffing across banking, shopping, and email accounts. Since password reuse remains extremely common, a single exposed login here can lead to account takeover, identity theft, or financial fraud on completely unrelated services.

How a 'Private' Combolist Like This Is Built

A private combolist is a compiled file of email or username and password pairs that its creator intends to sell or trade selectively, often through Telegram channels, before it eventually leaks or is redistributed more widely. The '65' in the name likely refers to a batch or version number, suggesting this uploader has released similar files before under the same naming pattern.

Check If You Are Affected

If you had an account active around February 2026, it is worth checking whether your credentials appear in this leak. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can find out quickly whether your password needs to change.