What the Proxy Combolist Hands an Attacker: 10 Password Pairs

HEROIC analysts logged a combolist named Proxy, dated February 1, 2026, that lists 10 email and password pairs. Each password is stored in plain text and sits beside a URL. A scan of your email is the only way to learn whether one of the 10 belongs to you.

Ten Entries Mean Ten Ways In

Ten pairs means ten ways in, and none of them has to be cracked. The attacker reads the password, opens the URL, and enters both. A match on any of the ten can then be tested on other sites, where the same password may have been used again. The URLs even tell the attacker which login page to open first.

The Fields Behind the Ten Entries

• Email addresses, the names that identify each login.
• Plaintext passwords, in full and unhashed.
• URLs, the login pages the pairs were gathered from.

When a Password Outlives the Date on the File

The date on the file is February 1, 2026, but a password does not expire on its own. It keeps functioning wherever it is in use. The person who picked it may have carried it into newer logins, and each of those is exposed if the pair is tested.

The Plain Meaning of a Combolist

A combolist is a text file of email and password pairs collected from different places so that attackers can try them on other sites in bulk. The word Proxy is the file's label. It does not describe the pairs or name any service, and it should not be read as a statement about anyone.

What to Do If You Are on the List

Begin here: scan your email and see your information. If you find a match, replace the password on every site that used it, with a new and different password for each. Acting soon matters, because a password that stays unchanged stays available to whoever holds the file. Personal and work addresses are scanned in the same way, so check both.