The ‘274K Gmail Combolist’ Dump Contains Exactly 145,774 Records

The "274K Gmail Combolist" Dump Contains Exactly 145,774 Records

On May 19, 2026, HEROIC analysts identified a combolist titled "274K GMAIL Combolist 05-04" circulating on Telegram. Despite the name suggesting a larger total, HEROIC's analysis confirmed 145,774 records pairing Gmail-linked email addresses with plaintext passwords and the URLs of the accounts they access, tied to United States users.

Why a Verified Gmail Combolist of This Size Is Dangerous

Gmail accounts are often the master key to a person's digital life, tied to everything from banking alerts to password resets on other services. Because all 145,774 passwords in this file are stored in plaintext and paired with direct account URLs, attackers can move straight to testing real logins rather than guessing which sites they belong to.

What Was Exposed in the 145,774-Record Gmail Dump

• Gmail linked email addresses
• Plaintext passwords
• URLs tied to each account

Why a Leak of This Size Matters for So Many People

With 145,774 records, this dump gives attackers a large enough pool to run automated credential stuffing across many other websites at once. Because Gmail addresses are frequently reused as a login for banking, shopping, and social media, a single successful match can cascade into account takeover, identity theft, and financial fraud across several accounts at once.

How a Gmail-Focused Combolist Like This Gets Built

Combolists that target a single provider like Gmail are typically assembled by filtering larger batches of stolen credentials, gathered through stealer malware, phishing campaigns, or older breaches, down to just the entries tied to that email domain. Naming the file "274K" likely refers to the size of the original batch before filtering or verification reduced it to the 145,774 records confirmed here, which is common practice among sellers looking to advertise a bigger number than what actually ships.

Check If Your Gmail Account Is Among the 145,774 Exposed

Given the scale of this leak, it is worth checking your Gmail address directly rather than assuming you are not affected. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can find out in moments and change your password before it is used against you.