The USA 7.31 Leak Means Someone Could Be Logging Into Your Accounts

HEROIC analysts identified a large combolist called USA 7.31 uploaded by a Telegram User, shared on 28-Feb-2023. The file contains 297,525 records, pairing email or username with plaintext passwords, along with the URLs of the accounts each pair unlocks.

Why This Is Dangerous

Picture someone sitting down with this file and simply trying each of the 297,525 logins one after another. Because the passwords are in plaintext and already matched to a specific URL, there is no cracking or guessing involved. Whoever has this file can attempt to log into real accounts right now, and there is no way for you to know it is happening until something goes wrong.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the affected login pages

Why This Matters

With nearly 300,000 credential pairs in one file, this leak is large enough to support automated credential stuffing across many different websites at once. If you have reused a password from an account tied to this leak, attackers can use that same login to attempt account takeover on your email, banking, or social media, opening the door to financial fraud and identity theft.

How Combolists Work

A combolist combines stolen email addresses or usernames with their matching passwords into a single organized file, typically gathered from past breaches, phishing campaigns, or stealer malware. These files circulate on Telegram and dark web forums, where criminals load them into automated tools capable of testing hundreds of thousands of logins across many websites in a short amount of time.

Check If You Are Affected

Rather than wondering if you are one of the 297,525 people in this leak, check directly. HEROIC's free breach scanner compares your email against a database of more than 400 billion leaked records, including combolists like this one, and tells you right away if you have been exposed. Run a free scan now and change any passwords you have reused elsewhere.