The Att.net Base Breach Put 1,045,030 Stolen Logins Online

HEROIC analysts identified a combolist labeled "1.11 Million Att.net Base" circulating on a Telegram channel in April 2023. The file paired 1,045,030 email addresses with plaintext passwords and the URLs of the sites those logins belong to, the standard format attackers use to automate login attempts across the web.

What the Att.net Base Combolist Contains

Over a million email and password pairs sit in this single file, all stored in plaintext and linked to the URL of the site each one unlocks. That format means an attacker does not need to crack or guess anything, they load the file into an automated tool and let it test every entry against matching websites.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each credential pair to its original login page

Why This Matters

A file of over a million records is exactly the kind of dataset used for large-scale credential stuffing, where bots try leaked logins against dozens of popular sites at once. Anyone whose email and password appear here faces a real risk that a reused password elsewhere, banking, email, or shopping, gets tried and unlocked. Because these are email account credentials, a successful login can also let an attacker reset passwords on other services tied to that inbox.

How Combolists Like This One Are Built

Combolists are compiled by merging credentials pulled from older breaches, phishing kits, and malware logs into a single searchable file, then formatted as email:password or email:password:URL so they can be fed straight into automated login tools. They are traded and sold cheaply on Telegram and dark web forums because they let low-skill attackers run large-scale login attempts with almost no technical effort. A file's age does not make it safe. Old combolists still work against anyone who has not changed the password since.

Check If You Are Affected

You do not have to guess whether your information is sitting in a dump like this one. HEROIC's free breach scanner checks your email address against more than 400 billion leaked records pulled from combolists, stealer logs, and dark web marketplaces. Run a free scan, and if a match turns up, change that password everywhere else you have used it.