17,274,039 Plaintext Logins Leaked in the Qip.ru_DB_cource File

A file HEROIC analysts call Qip.ru_DB_cource surfaced on August 23, 2026, carrying 17,274,039 records of email addresses, plaintext passwords, and the URLs those logins unlock. Scan your email to check whether your address is one of the 17,274,039 entries inside it.

At more than seventeen million records, this is one of the largest combolists HEROIC has reviewed recently, and every password in it is stored in readable plain text. That combination means an enormous number of accounts could be tried by attackers with almost no effort.

What's Packed Into the Qip.ru_DB_cource File

• Email Addresses: Confirms a real, working account an attacker can target.
• Plaintext Passwords: Immediately readable, with no cracking needed before use.
• URLs: Shows exactly which site each credential pair is meant to unlock.

Why a File This Large Raises the Stakes

A combolist of this scale is typically run through automated tools that try each pair against many other sites at once, looking for reused passwords. Given the volume here, even a small reuse rate across 17 million records still adds up to a large number of accounts put at risk of takeover, financial fraud, or email hijacking.

How a Combolist This Size Gets Compiled

Combolists are built by merging email and password pairs gathered from a wide range of sources into one organized file, frequently grouped by the site each pair is tied to. Once compiled, files like this circulate widely so that anyone holding them can test the credentials elsewhere.

Responding to the Qip.ru_DB_cource Exposure

Scan your email first to see if you're included. If you are, change that password everywhere you've reused it, especially on email and financial accounts, and turn on multi factor authentication wherever it's offered. This applies to work email just as much as personal email, since either one can be the first domino.