The all_hits Combolist Gives Hackers Working Logins and Passwords

What HEROIC Analysts Found in the all_hits Telegram Dump

On March 20, 2026, HEROIC analysts identified a combolist labeled "all_hits" shared on Telegram. The file contains 181 records, each combining an email address or username with a plaintext password and the URL the credentials were used on. The name suggests the uploader claims every record in the file is a confirmed, working login.

Why This Is Dangerous

If the "all_hits" label is accurate, every one of the 181 records was a working login at the time it was collected. With passwords stored in plaintext, an attacker does not need to crack or decrypt anything. They can simply take a record and use it directly, whether that means logging into an email inbox, a shopping account, or anywhere else the same password is used.

What Was Exposed in the all_hits Leak

• Email addresses and usernames
• Plaintext passwords (not hashed or encrypted)
• URLs tied to each set of credentials

Why This Matters Even at a Small Scale

With only 181 records, this is a small file, but small does not mean low risk for the people inside it. An attacker with a verified working login can move straight into credential stuffing on other sites, account takeover, identity theft, or financial fraud, all without needing to guess or brute-force anything first.

How Attackers Use a Verified Combolist Like all_hits

Combolists marketed as containing only confirmed "hits" are typically produced by running stolen credentials through automated checker tools that test each login before the file is packaged for sale or sharing. Only pairs that successfully logged in somewhere make it into the final list, which is why files like all_hits are considered more valuable and more dangerous than unverified dumps.

Check If You Are Affected

If your email address is one of the 181 records in the all_hits dump, you want to know now, not after an attacker has used it. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including verified combolists like this one, so you can act before someone else does.