The “USA..” Combolist Quietly Leaked 9,996 Login Credentials

HEROIC analysts identified a small combolist labeled "usa.." that surfaced on Telegram in May 2026. The file contains 9,996 records, each pairing an email address with a plaintext password and the URL of the site the credentials were used on. The listing is associated with the United States and has been marked as a verified breach. Why the USA.. Combolist Is Dangerous: While 9,996 records is a modest count compared to some dark web dumps, every one of those records is immediately usable by an attacker. Because the passwords are stored in plaintext rather than hashed or encrypted, no cracking is required. Anyone who downloads this file can plug the email and password pairs directly into a script and start testing them against real websites within minutes, and the attached URLs tell them exactly where to try each one first. What Was Exposed in the USA.. Combolist: email addresses used as account usernames, plaintext passwords stored without any protection, and URLs showing which sites or services each login belongs to. Why This Matters Even for a Smaller Leak: A breach of under 10,000 records can feel less alarming than a headline-grabbing million-record dump, but the danger to each individual affected is identical. If your email and password appear in this file, an attacker can attempt credential stuffing against your other accounts, including email, banking, and social media, especially if you have reused that same password anywhere else. Small combolists like this one are also frequently combined with other leaked files, multiplying the risk over time. How a Combolist Like This One Works: A combolist is a plain text file that pairs usernames or email addresses with matching passwords, typically compiled from older breaches, phishing pages, or infected devices and then shared or sold on platforms like Telegram. Unlike a single company's breached database, a combolist can pull from many unrelated sources at once, which is why file names like "usa.." often give little indication of where the data actually originated. Its value to criminals lies entirely in being ready to use immediately, with no additional effort needed to unlock the credentials inside. Check If You Are Affected: Even a leak of this size is worth checking against your own information. HEROIC's free breach scanner searches a database of more than 400 billion exposed records, including combolists like this one, so you can quickly find out whether your email address was part of this leak or any other breach on file.