HEROIC Analysts Found 99,667 Records in the User Pass Part 4 2 Leak

HEROIC Analysts Found 99,667 Records in the "User Pass Part 4 2" Combolist

On 18-Jan-2023, HEROIC analysts identified a combolist titled "User pass part 4 2" uploaded by a Telegram user. The file contained 99,667 records, each pairing an email address with a plaintext password and the URL of the account the credentials unlock.

Why This Is Dangerous

Because the passwords in this file are stored in plaintext and already matched to specific URLs, an attacker has everything needed to log in immediately, no password cracking, no research required. At nearly 100,000 records, this list is large enough to fuel automated attacks against a wide range of accounts at once.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each credential pair to its login page

Why This Matters

A combolist this size is a prime tool for credential stuffing, where attackers run automated scripts that test every email and password combination against banks, email providers, and shopping sites in bulk. If your credentials appear here and you have reused that password anywhere else, you face a real risk of account takeover, identity theft, or financial fraud.

How Combolists Work

A combolist is a compiled file of email-and-password pairs, often split into numbered "parts" like this one and released in batches on Telegram channels or dark web forums. Splitting a large dataset into parts, as seen in the "part 4 2" naming here, lets sellers distribute credentials gradually or divide a bigger source list among multiple buyers.

Check If You Are Affected

With 99,667 records in this leak, the odds that your email address is included are worth taking seriously. HEROIC's free breach scanner checks your address against a database of more than 400 billion leaked records, so you can find out immediately and secure any accounts using a reused password.