302,408 USA iCloud Logins Quietly Surfaced on the Dark Web

What HEROIC Analysts Found

In April 2023, HEROIC analysts identified a combolist file labeled "350K USA Domain Icloud," uploaded to a Telegram channel. The file contained 302,408 records pairing email addresses, most tied to iCloud accounts belonging to US users, with plaintext passwords and the URLs of the sites those logins belong to.

Why This Is Dangerous

This list was put together specifically around iCloud accounts, which is what makes it especially concerning. An iCloud login is not just email, it can also connect to Apple ID, iMessage, Find My iPhone, and any photos or backups stored in iCloud. Because the passwords here are plaintext and matched to the exact login page, anyone with the file could sign in directly, no cracking required.

What Was Exposed

• Email addresses (iCloud accounts)
• Plaintext passwords
• URLs linking each login to the site it belongs to

Why This Matters

An iCloud account often works as a hub for someone's Apple devices, meaning a compromised login could give an attacker access to more than just email. Since a lot of people reuse the same password across services, anyone in this file is also at risk of credential stuffing attacks that try the same email and password combination on banking, shopping, and other accounts.

How Combolists Work

A combolist is a compiled file of username or email and password pairs, gathered from older breaches, stealer logs, or leaked databases and packaged for easy use. This particular list was filtered down to a single domain, iCloud, and a specific region, USA, which criminals often do to target a specific type of account or run more focused attacks with a checker tool.

Check If You Are Affected

If you use an iCloud email address, it is worth checking whether your login shows up in this leak or any other. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can find out quickly and know if it is time to update your password.