Combolist Leak: 100 Logins With Plaintext Passwords Exposed

If you reuse the same password across a few sites, a combolist like this one is exactly what puts that habit at risk. HEROIC analysts logged a small combolist dated 18 Jun 2020 holding 100 records that pair email addresses with plaintext passwords and linked URLs. The file is compact, but every entry in it is a working login that someone can try right now.

Why a Small List Still Causes Real Damage

Size does not determine risk here. Because the passwords sit in plaintext, an attacker does not need to crack anything, they can copy each pair straight into a login form. The attached URLs point to the exact sites the credentials were captured from, which turns a generic list into a targeted set of accounts an attacker already knows how to reach.

What Was Exposed

• Email addresses: confirm a working inbox that can be targeted with phishing or used to reset other accounts.
• Plaintext passwords: usable immediately, no cracking required before an attacker tries them.
• URLs: tell an attacker precisely which site each credential unlocks.

The Real Consequence of a Working Login

A single valid pair is enough to start credential stuffing against other services, since so many people repeat passwords. Anyone in this file could see their email account, a shopping account, or a work login taken over within minutes of the list circulating.

How a Combolist Like This Gets Built

Combolists are compiled from older leaks, scraped pages, and stealer logs, then repackaged and traded in bulk. Because it draws on previously exposed data, a listing this size can still hold current, working logins if the passwords were never changed.

Is Your Email Address Sitting in a List Like This?

Start by scan your email against HEROIC's records to see if it turns up in this or any other leak. If it does, change the password on the affected account immediately and switch on multifactor authentication wherever it is offered. This check matters whether the address you use is personal or tied to your job.