Researchers Link USA Database Combos HQ to 480,436 Stolen Logins

In January 2023, HEROIC analysts identified a large combolist file uploaded to a Telegram channel under the label "USA Database Combos HQ." The file contained 480,436 records pairing email addresses with plaintext passwords, along with the URLs of the accounts each credential belonged to. Why This Is Dangerous At nearly half a million records, this combolist gives whoever holds it a large pool of ready-to-use logins. Because the passwords are stored in plaintext and already matched to specific website URLs, attackers can skip straight to testing these credentials against the exact accounts they belong to, and against other sites where a password may have been reused. What Was Exposed Email addresses Plaintext passwords URLs of the accounts tied to each credential pair Why This Matters A file of this size is valuable to criminals precisely because of its scale. Automated credential stuffing tools can run all 480,436 email and password pairs against banking sites, email providers, and shopping platforms in a matter of hours. Anyone in this file who reused a password elsewhere faces a real risk of account takeover, financial fraud, or identity theft. How Combolist Breaches Work A combolist pairs email addresses or usernames with passwords, typically compiled from older breaches, stealer logs, and scraped login attempts, then merged into a single large file. Criminals frequently label these files by region or theme, as with this one, and trade them on Telegram channels and dark web forums where other attackers can put them to immediate use. Check If You Are Affected HEROIC's free breach scanner checks your email address against more than 400 billion breached records, including large combolists like this one. Run a free scan today to see if your credentials were exposed.