The Supercell noreplyid Combolist: 55 Stolen Login Credentials Leaked

In March 2025, HEROIC analysts identified a small combolist file uploaded to a Telegram channel, associated with the domain noreplyid.supercell.com. The file contained 55 records pairing email addresses with plaintext passwords and the URLs tied to each account. Supercell is the mobile game developer behind titles like Clash of Clans, Clash Royale, and Brawl Stars, and "noreplyid" addresses are typically used for automated account verification emails from services like these. Why This Is Dangerous Gaming accounts are often overlooked as a security risk, but many are linked to saved payment methods, purchased in-game currency, and years of progress. Because the passwords in this file are stored in plaintext, anyone who obtains it can log in immediately without needing to crack anything, and if the account holder reused that password elsewhere, the damage can spread far beyond the game itself. What Was Exposed Email addresses Plaintext passwords URLs of the accounts tied to each credential pair Why This Matters For the 55 people in this file, an attacker could hijack game accounts to steal purchased items or currency, or use the exposed email and password combination to try logging into banking, shopping, or email accounts elsewhere. Password reuse is what turns a small leak like this into a much bigger problem for the people affected. How Combolist Breaches Work A combolist pairs email addresses or usernames with passwords, typically gathered from stealer logs, older leaks, or credential stuffing attempts against login pages. Attackers often organize these files by the website or service the credentials belong to, then trade them on Telegram channels and dark web forums where other criminals can put them to use. Check If You Are Affected HEROIC's free breach scanner checks your email address against more than 400 billion breached records, including small combolists like this one. Run a free scan today to see if your credentials were exposed.