USA COMBO VIP Combolist Quietly Leaked 9,592 Email and Passwords

What HEROIC Analysts Found

In June 2026, HEROIC's threat intelligence team spotted a combolist called USA COMBO VIP after it was quietly uploaded to Telegram by an individual user. The file held 9,592 records pairing email addresses with plaintext passwords, along with the URLs of the accounts they belong to.

Why This Is Dangerous

Because these passwords were saved and shared in plaintext, anyone who downloads this list can read your password directly, no cracking or decoding needed. If you have used that password on more than one site, an attacker already holds the key to every account where it was reused.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated account URLs

Why This Matters

Lists like USA COMBO VIP circulate quietly on Telegram before wider criminal use, and that quiet spread is part of what makes them dangerous. Attackers load combolists like this into automated tools that try each email and password pair across banking, email, and social media logins, a method known as credential stuffing. Reused passwords turn one small leak into account takeover, identity theft, and financial fraud across multiple platforms.

How Combolists Work

A combolist pairs a username or email with a password, usually one per line in a plain text file. These lists are typically pieced together from older breaches, stealer malware logs, and scraped login data, then bundled and traded through Telegram channels and dark web marketplaces. They require no technical skill to use, which is exactly why they remain such a common tool for account takeovers.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion breached records, including combolists like USA COMBO VIP. If your details show up, change that password immediately, along with any other account where you have reused it.