U.S. Users Targeted: Combo USA Exposes 3,224 Passwords

HEROIC identified a stealer log file titled "Combo USA" shared on Telegram in January 2025. The dataset contains 3,224 credential records that have been specifically filtered to target American users. Each entry includes an email address, a plaintext password, and the URL of the service where the credential was captured. This geographic filtering makes the dump particularly useful for attackers targeting U.S.-specific banking, healthcare, and government services.

Plaintext Passwords Offer Zero Protection

None of the 3,224 passwords in Combo USA are encrypted or hashed. They exist as plain, readable strings that can be copied directly into any login form. For American users whose credentials appear in this file, every account associated with that password is immediately vulnerable. There is no decryption barrier, no computational cost — the attacker simply reads the password and uses it.

What Was Exposed

• Email Addresses — American user accounts spanning personal and professional email providers
• Plaintext Passwords — completely unencrypted and ready for immediate use
• URLs — the U.S.-focused websites and services from which credentials were harvested

Geographic Targeting Amplifies the Credential Stuffing Threat

A geo-filtered combo list like this one is prized by cybercriminals because it concentrates credentials from a single country. Attackers can target U.S. banking institutions, healthcare portals, IRS accounts, and state government services with high confidence that the credentials will match the platform's user base. The 3,224 records in Combo USA represent focused ammunition for attacks against American digital infrastructure, where password reuse turns each entry into a master key for multiple services.

Stealer Logs and the Infostealer Supply Chain

The data in Combo USA was extracted by infostealer malware running on infected American devices. Trojans like RedLine, Raccoon, and Stealc infiltrate systems through phishing emails, infected software downloads, and compromised websites. Once installed, they silently harvest every credential saved in the browser, along with autofill data, session cookies, and cryptocurrency wallet information. The stolen data is then sorted by geographic origin — "USA" in this case — and packaged for distribution on Telegram channels where other criminals purchase or download these curated collections.

Check If Your Credentials Were Exposed

American users should take this leak seriously, especially if they use the same password across multiple services. HEROIC's breach scanner searches more than 400 billion compromised records to reveal whether your email or password has appeared in Combo USA or any other known data breach. A quick scan can alert you to compromised credentials before attackers use them to access your bank accounts, health records, or personal email.