The USA Mix Combolist 4.2M Put 3.9M Stolen Email and Password Pairs Online

HEROIC analysts identified this stealer log on 25-Dec-2025. The breach exposed 3,946,105 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as Combolist 4.2M USA Mix Fresh 100, uploaded by a Telegram user.

Why This Is Dangerous

Nearly four million verified email and password pairs targeting US account holders are now circulating on the dark web. With credentials labeled fresh and fully verified, every record in this file represents a real person whose login information is actively being shared among criminals. At this scale, the potential for widespread account takeovers, financial fraud, and identity theft is severe.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs (website addresses where each credential was used)

Why This Matters

The Combolist 4.2M USA Mix breach puts millions of Americans at risk of credential stuffing attacks. Criminals feed these records into automated tools that try each combination across banking portals, e-commerce accounts, email providers, and subscription services. Victims commonly discover the breach only when unauthorized transactions appear or when they are locked out of their own accounts. With almost four million records exposed, the likelihood that any given person's credentials are included is significant.

How a Stealer Log Works

Large combolists like this one are assembled from the output of multiple infostealer malware campaigns. Each campaign infects thousands of devices, harvesting stored passwords and website addresses. The collected data is then merged, sorted by country, and verified for accuracy before being distributed. This is an organized criminal operation that runs continuously, producing fresh batches of working credentials.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.