HEROIC Researchers Link the AU Combolist to 197,232 Credentials

HEROIC analysts traced a dataset, tracked as COMBOLIST AU FRECH, to a Telegram upload on 21-Oct-2025. The file contains 197,232 records, including email addresses, plaintext passwords, and the login page URLs tied to those accounts. As the name indicates, this is a combolist, a large compiled list of email and password pairs rather than a breach of a single company.

Why This Is Dangerous

Researchers who examine files like this one look for scale and structure, and this combolist has both. With 197,232 records bundled together, it is built for automated attacks that test each pair against many websites at once rather than targeting one victim by hand.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

A combolist of nearly 200,000 records gives attackers a large enough list to run automated credential stuffing campaigns across many services at once. If a password from this file is reused, it can lead to account takeover, and in more serious cases identity theft or financial fraud.

How Combolists Work

A combolist is assembled by combining email and password pairs from multiple sources, often older breaches, stealer log malware, and previously leaked databases, then merging and cleaning them into a single large file. Sellers label combolists by region and freshness, as seen here with a batch marked for the AU region, before sharing them through channels like Telegram where buyers test them against real accounts.

Check If You Are Affected

If you want to know whether your information appears in the COMBOLIST AU FRECH file or any other breach, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a scan now and change any password that may have been exposed.