The ‘Taiwan 4’ Leak Gives Hackers Enough to Hijack 139,485 Accounts

HEROIC analysts identified a combolist file labeled "Taiwan 4" by the person who uploaded it to a Telegram channel on February 18, 2023. The file contains 139,485 records pairing email addresses with plaintext passwords, along with the URLs those credentials were used on.

Why This Is Dangerous

This file hands an attacker everything needed to log in as someone else with almost no extra work. The passwords are stored in plaintext, so there is no encryption to crack, and the attached URLs tell an attacker exactly which site each login belongs to. Instead of guessing, criminals can go straight to the target site and try the credentials directly.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each credential to the site it was used on

Why This Matters

Lists like this one are the raw material for credential stuffing, where automated tools test each email and password pair against banking sites, email providers, and online retailers. Since so many people reuse passwords across multiple accounts, a single exposed credential can cascade into account takeover on other services, opening the door to identity theft and financial fraud well beyond the original login.

How This Combolist Was Put Together

A combolist compiles username or email and password pairs, typically pulled from earlier breaches, stealer logs, or other leaked data and packaged into one list for easy use. Because it strips out everything except the login pairs, it is faster for criminals to load into automated login tools than a raw database dump would be. Telegram channels have become a common place for these files to circulate and change hands.

Check If You Are Affected

If you think your email address might appear in this or a similar combolist, HEROIC's free breach scanner checks your information against a database of more than 400 billion compromised records. Run a scan and change any passwords you have reused elsewhere.