Exactly 216 US Logins Leaked in Telegram Combo Dump

A Small, Precise Batch of Leaked Logins

HEROIC analysts found a file titled "USA2" uploaded to Telegram on July 5, 2026. The list contains exactly 216 records, each combining an email address with a plaintext password and the URL the login was used on.

Why This Is Dangerous

Small does not mean harmless. Every one of these 216 records includes a plaintext password already matched to its login URL, meaning an attacker can access each account immediately without cracking or guessing a single character.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

With 216 confirmed working logins, this list is small enough to be sold or shared quietly, which can mean it stays under the radar longer than larger, more publicized leaks. If any of these passwords are reused on other sites, the risk extends to credential stuffing and account takeover well beyond the original 216 accounts.

How Small, Regional Combo Lists Are Created

Lists labeled by country or region, like "USA2," are often carved out of a larger batch of stealer log data and sold separately to buyers who want a specific geography. The underlying credentials are typically harvested by information-stealing malware, then filtered and packaged into smaller, targeted files like this one.

Check If You Are Affected

Since this leak is small and easy to overlook, checking directly is the surest way to know your status. HEROIC's free breach scanner searches more than 400 billion leaked records, so you can quickly confirm whether your email and password were part of this file.