What Hackers Can Do With 98,161 Stolen Shopping Baset Logins

In May 2023, HEROIC analysts reviewed a combolist file named "103k shopping baset" that a Telegram user uploaded, tied to a leak date of May 7, 2023. Despite the "103k" in the filename, the verified count is 98,161 records, still pairing email addresses with plaintext passwords and URLs. Why This Is Dangerous: With a working email, plaintext password, and the URL of the site it unlocks, an attacker has everything needed to log in without guessing. The "shopping" reference in the filename suggests these credentials may be tied to e-commerce accounts, which often have saved payment methods attached. What Was Exposed: - Email addresses - Plaintext passwords - URLs pointing to the shopping or online accounts each credential unlocks Why This Matters: If attackers can log into an online shopping account, they can potentially place orders using stored payment details, redirect deliveries, or harvest personal information for identity theft. Because so many people reuse the same password across shopping sites, banking apps, and email, one leaked shopping login can open the door to much bigger financial fraud through credential stuffing. How a Combolist Like This Works: A combolist gathers stolen email-and-password pairs, often themed around a specific type of account, in this case shopping logins, and compiles them into a single file for easy testing. Attackers load these files into automated tools that try each pair against shopping platforms and payment portals, flagging any that succeed for further abuse. Check If You Are Affected: Whether the count is 98,161 or 103,000, the risk to any individual account is the same. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, so you can quickly confirm whether your shopping credentials were part of this leak.