The 160K Canada Combo List Holds More Logins Than a Small City

A combolist named "160K-Canada-Combo-List-Fresh" surfaced on Telegram in September 2024, containing 151,680 records of email addresses, plaintext passwords, and the URLs tied to each login. At that size, the file holds more logins than the population of many mid-size cities.

Why This Is Dangerous

The word "Fresh" in the file's name is criminal shorthand for recently compiled and not yet widely circulated, which matters because newer credentials are more likely to still be active. With 151,680 records in a single file, an attacker can automate login attempts at a scale that would be impossible to do by hand.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each login

Why This Matters

A file of this size dramatically increases the odds that any given password was reused elsewhere, making credential stuffing a real threat for the people included. Because the passwords are stored in plaintext, attackers can begin testing logins immediately, without needing to crack anything first.

How a Combolist This Size Gets Assembled

Large combolists like this one are usually built by combining multiple smaller batches of stolen credentials, often pulled from stealer malware and older breaches, then labeling and marketing the combined file toward a specific region or theme to attract buyers on Telegram.

Check If You Are Affected

Search HEROIC's free breach scanner, which checks your email against more than 400 billion leaked records, to see if you are among the 151,680 accounts in this file, and update any reused passwords immediately.