The 500x Exaltz Leak: 499 Passwords Exposed. Yours Might Be One.

The "500x Exaltz" Combolist Exposed 499 Login Credentials

On September 19, 2025, HEROIC's threat intelligence analysts identified a combolist named "500x exaltz" uploaded by a user on Telegram. The file contains 499 records, each pairing an email address with a plaintext password and the URL of the login page the credentials belong to. Most of the affected accounts are tied to the United States.

Why This Is Dangerous

The passwords in this file are stored in plaintext, so there is nothing to decrypt or crack before they can be used. Each record also includes the exact URL where that email and password combination works, meaning an attacker does not need to search for the right site, it is already listed. That level of detail turns a simple list of stolen data into a ready to use set of working logins.

What Was Exposed in the 500x Exaltz Dump

• Email addresses
• Plaintext passwords
• URLs linking each credential pair to its login page

Why This Matters Even at Under 500 Records

A leak of 499 records is small next to the breaches that make headlines, but the danger to each person in it is the same. If your password here is one you use anywhere else, attackers can attempt credential stuffing across your other accounts, from email to banking to social media. A single reused password is often all it takes to lead to account takeover or financial fraud.

How a Combolist Like 500x Exaltz Comes Together

Combolists like this one are usually built by combining stolen credentials from several different sources rather than one breach. Threat actors pull email and password pairs from older leaks, phishing pages, or malware infections, confirm they still work, and package them with the matching login URL. The finished file is then shared or sold on Telegram channels and dark web forums to anyone looking for accounts to break into.

Check If Your Email Was in the 500x Exaltz Leak

You do not have to guess whether you are one of the 499 people in this file. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including combolists like this one, and lets you know right away if you have been exposed. If you find a match, change that password immediately, and anywhere else you used it too.