The Mansory 2 Dump: 3 Million Stolen Login Credentials Surface Online

HEROIC analysts identified "mansory 2," a combolist uploaded to Telegram in March 2026 containing 3,006,423 records. Each record pairs an email address or username with a plaintext password and an associated URL, making this one of the larger credential dumps HEROIC has tracked from Telegram this year.

Why the Mansory 2 Leak Is Dangerous

At over 3 million records, this combolist gives attackers enormous scale. Automated tools can run every one of these email and password pairs against major websites within hours, and because password reuse is so common, even a small percentage of hits translates into tens of thousands of compromised accounts.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

A dump of this size is exactly what fuels large-scale credential stuffing attacks, account takeover, and downstream identity theft. When millions of working email and password combinations are in circulation, individual victims often have no idea they are exposed until an account is drained or a login notification arrives from somewhere they never signed up.

How a Combolist This Large Gets Built

Combolists of this scale are usually stitched together from multiple older breaches and stealer log outputs, then deduplicated and verified before being sold or freely distributed. The "mansory 2" naming suggests this is a follow-up or expanded version of an earlier file, a common pattern among Telegram sellers who release combolists in numbered batches.

Check If You Are Affected

With more than 3 million credentials now circulating, checking your own exposure takes only seconds. HEROIC's free breach scanner searches over 400 billion leaked records, including large combolists like this one, so you can see if your email has appeared and secure your accounts before someone else uses your data.