USA Mail Access Moon 2 Combolist Quietly Leaks 219 Logins

USA Mail Access Moon 2: 219 Logins Quietly Exposed

In April 2026, HEROIC analysts came across a combolist called "USA Mail Access Moon 2," uploaded to a Telegram channel without much fanfare. The file contained 219 records pairing email addresses with plaintext passwords, along with the URLs those credentials were tied to. It is a small list, and it never made headlines, but every one of those 219 people is now exposed all the same.

Why This Is Dangerous

Small, quiet leaks like this one are easy to overlook, which is exactly what makes them dangerous. There is no major news story to prompt people to change their passwords, so credentials in files like this can sit unnoticed and usable for a long time. Because the passwords are stored in plaintext, an attacker who finds this file does not need to do any extra work, the email and password pairs are ready to use immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated accounts

Why This Matters

Even a modest combolist feeds directly into credential stuffing attacks. Automated tools take confirmed email and password pairs and quietly test them against other popular sites, hoping the same password was reused. If it was, the result can be account takeover, unauthorized purchases, or identity theft, consequences that are anything but small, regardless of how quiet the original leak was.

How a Combolist Attack Works

A combolist is a compiled file of email or username and password pairs, typically pulled from earlier breaches, malware infections, or scraped data and shared on channels like Telegram. Unlike a major breach announcement, these lists often circulate with little attention, which can make them feel less urgent even though the risk to the people in them is exactly the same. Because this list stores passwords in plaintext, there is no encryption standing between the data and misuse.

Check If You Are Affected

Quiet leaks are still leaks. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records and will tell you right away if your information appears in this file or any other. If you find a match, change that password now and avoid reusing it anywhere else.