Identity Theft Risk Grows After 1,176 QQ.com Logins Leaked

HEROIC analysts identified a combolist tied to qq.com, the popular Chinese messaging and email platform, uploaded by a Telegram user on May 31, 2026. The file contains 1,176 records, each pairing a qq.com email address with a plaintext password and the URL the credentials unlock. Why this is dangerous: qq.com accounts are often connected to WeChat, QQ messenger, gaming platforms, and other Tencent services, meaning a single compromised login can open doors far beyond email. Because the passwords in this file sit in plaintext, an attacker does not need to crack anything, they can simply try each credential pair and see what opens. What was exposed: the dataset includes qq.com email addresses, plaintext passwords with no protection, and the specific URLs tied to each account, giving anyone who obtains the file a direct, working login for all 1,176 records. Why this matters: identity theft becomes far easier once an attacker has a working email and password pair, since so many people use the same login across messaging, banking, and shopping accounts. Criminals run credential stuffing attacks against lists like this one, testing each pair against other popular services, and a single successful match can snowball into account takeover and financial fraud well beyond the original qq.com account. How this combolist was likely built: combolists like this one are usually assembled by combining older breaches, stealer malware infections, or phishing pages, then sorted by the email domain they belong to, in this case qq.com. Sorting by provider makes the list more valuable to buyers who want to target users of a specific platform, and files like this frequently trade hands on Telegram before wider security researchers or the public ever hear about them. Check if you are affected: if you use a qq.com email address, or reuse the same password on other accounts, it is worth checking now. HEROIC's free breach scanner searches more than 400 billion leaked records, giving you an instant answer about whether your credentials were exposed so you can change them before someone else takes advantage.