This Gmail Combolist Is Smaller Than a Classroom: Just 499 Records

In July 2026, HEROIC analysts found a small combolist file labeled "40 2___gmail__1000010500" uploaded to a Telegram channel. The file is modest in size, containing 499 records, each pairing an email address with a plaintext password and the URL of the login page it unlocks. Despite the cryptic file name, the contents are straightforward: a short list of Gmail-related credentials gathered and shared by a Telegram user. Why This Is Dangerous: Because the 499 passwords in this file are stored in plain text, no cracking or decoding is required before someone can use them. Each record includes the exact login URL, so an attacker can go straight to the account and attempt to sign in with the matching email and password. What Was Exposed: - Email addresses - Plaintext passwords - URLs for the associated login pages Why This Matters: A file this size is easy to overlook, but every one of the 499 people in it faces the same risk as someone caught up in a much larger breach. If any of these passwords are reused on banking, shopping, or social media accounts, attackers can attempt credential stuffing against those other sites using the exact same login. How Combolists Work: Combolists are files that bundle together email or username and password pairs pulled from multiple older breaches, stealer logs, or previous leaks into one list. They are frequently small, targeted collections like this one rather than sprawling databases, and are traded cheaply or given away for free on Telegram channels and hacking forums because they require little effort to assemble. Check If You Are Affected: Even a small leak like this one is worth checking against. HEROIC's free breach scanner searches a database of more than 400 billion breached records, including combolists like this Gmail-focused file, so you can confirm in seconds whether your email or password was exposed.