What 2.1 Million Leaked R2Games_2.1M_2015 Logins Could Cost You

HEROIC analysts found a 2015 combolist labeled R2Games_2.1M_2015 shared on Telegram on August 23, 2026, containing 2,117,590 records of email addresses, plaintext passwords, and URLs tied to R2Games accounts, based on the file's own name. Scan your email to see if your address is part of this file.

With over two million records in a single file, this is one of the larger combolists HEROIC has reviewed recently. Every password is stored as readable text, so no cracking is needed before it can be tried, and the attached URL tells an attacker exactly where to try it.

What This Combolist Contains

• Email Addresses: identifies the account holder behind each record.
• Plaintext Password: usable immediately, with no cracking required.
• URLs: confirms exactly which login each credential belongs to.

What a File This Size Enables

A list of this scale supports automated login attempts across millions of accounts at once. Anyone who reused a password from an old gaming account on their email, banking, or work logins faces the real risk here, since those are the accounts worth far more to an attacker than the game account itself.

How a Combolist Like This Gets Built

Combolists are assembled by gathering email and password pairs, often from older leaks or infected devices, and organizing them into one file that can be tested against other sites at scale. A file named after R2Games means these are logins tied to that platform; it is not confirmation that R2Games's current systems were broken into.

Checking Your R2Games_2.1M_2015 Exposure

Scan your email to see if you are one of the 2,117,590 affected records. If you are, change this password everywhere you reused it, especially on accounts that matter more than an old gaming profile, and do it from a device you trust is clean. Work email deserves the same check as personal accounts.