From 2023, the ‘Unknown 12’ Telegram Leak Exposed 321,541 Accounts

HEROIC analysts identified a combolist file, tracked internally as "Unknown 12," that was uploaded to a Telegram channel on February 18, 2023. The file contains 321,541 records made up of email addresses paired with plaintext passwords, along with URLs linking those credentials to the sites they were used on.

Why This Is Dangerous

Because the passwords in this file are stored in plaintext rather than hashed or encrypted, anyone who downloads it can read the credentials exactly as they were typed by the original account holders. Paired with the associated URLs, an attacker does not need to guess where a password might work. They already know the site it belongs to, which turns this file into a ready-made toolkit for breaking into accounts.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking credentials to specific sites and services

Why This Matters

Combolists like this one are built for one purpose: automated login attempts at scale. Criminals feed lists of email and password pairs into bots that try each combination against banking sites, email providers, and shopping accounts, a technique known as credential stuffing. Because so many people reuse the same password across multiple services, a single leaked credential can lead to account takeover far beyond the original site, opening the door to identity theft and financial fraud.

How a Combolist Like This Gets Built

A combolist is a compiled file of username or email and password pairs, usually assembled by pulling credentials from older breaches, stealer logs, or leaked databases and combining them into one large, easy-to-use list. Unlike a raw database dump, a combolist is stripped down to just the login pairs, which makes it faster for criminals to plug into automated attack tools. Telegram has become a common distribution point for these files, with channels dedicated to sharing and trading them.

Check If You Are Affected

If you think your email address could be part of this combolist or any similar leak, HEROIC's free breach scanner checks your information against a database of more than 400 billion compromised records. Run a scan to see if your credentials have surfaced, and update any reused passwords right away.