The ‘US’ Leak: 27 Passwords That Could Unlock Bank and Email Logins

A Small Combolist Labeled "US" Exposes 27 Plaintext Logins In June 2026, HEROIC analysts found a combolist file simply labeled "US" uploaded to a Telegram channel. The file is small, containing 27 records that pair email addresses with plaintext passwords, but every one of those 27 credentials was posted in a form anyone could copy and use right away. Why 27 Leaked Passwords Can Still Unlock More Than Email A password is rarely used in just one place. If any of these 27 people reused their email and password combination elsewhere, that single leaked credential can act as a skeleton key, unlocking a banking app, a social media account, or a shopping profile that shares the same login. Small file size does not mean small consequence for the people involved. What Was Exposed Email addresses Plaintext passwords Associated URLs Why This Matters Even a tiny leak like this one feeds the same attacker toolkit as a massive breach: credential stuffing scripts don't care whether a list has 27 entries or 27 million, they'll run through all of them looking for a match. For the 27 people on this list, reused passwords could mean account takeover, identity theft, or financial fraud stemming from a single leaked login. How a Combolist Leak Works A combolist pairs usernames or emails with passwords, usually pulled from phishing pages, malware infections, or older breaches, then bundled into a file and shared or sold. Generic labels like "US" are common on Telegram, where small batches like this one often get merged into larger collections over time, extending their reach well beyond the original 27 accounts. Check If Your Login Is One of the 27 Whether a leak contains 27 records or 27 million, the personal risk is the same if your email is on the list. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can find out in seconds and change any password you've reused elsewhere.