One Telegram File Named ‘usa’ Exposed 10,000 Passwords

HEROIC analysts discovered a combolist simply named usa, uploaded to Telegram on May 2, 2026, containing 10,000 records of email addresses, plaintext passwords, and the URLs tied to each login. Why This Is Dangerous: The passwords in this file are stored in plaintext, meaning an attacker can use them immediately without cracking anything. Automated tools can test all 10,000 credential pairs against major websites within minutes, exploiting anyone who reused a password. What Was Exposed: Email addresses, plaintext passwords, and the login URLs associated with each account, giving attackers a complete, ready-to-use credential set. Why This Matters: A 10,000-record combolist is more than enough to power a credential-stuffing campaign. Attackers use lists like this to break into email, banking, and social media accounts wherever a password was reused, leading to account takeover and financial fraud. How This Combolist Was Built: A file generically labeled usa is typically a compilation pulled from multiple older leaks and stealer malware logs rather than a breach of one specific company. Sellers and Telegram users often bundle credentials this way and label them by country or region to make them easier to sell. Check If You Are Affected: HEROIC's free breach scanner searches more than 400 billion leaked records, including combolists like this one. Check your email now and change any password you've used on more than one site.