What a Combolist Breach Means for Negocios GT’s 4,363 Emails

HEROIC analysts identified a dataset tied to Negocios GT, a now-defunct business portal and directory for the Guatemalan market, circulating on a hacking forum. The breach is dated August 26, 2018, and exposed 4,363 records consisting of email addresses.

Why This Is Dangerous

No passwords were included in this leak, so it can't be used to log directly into any account. But a confirmed, working email address is still valuable to attackers on its own. It tells them the address is active and tied to a real business contact, which makes it a useful target for phishing emails, spam campaigns, and further attempts to gather more personal information.

What Was Exposed

• Email addresses of Negocios GT users and business contacts

Why This Matters

A leaked email address rarely stays isolated. It typically ends up merged into combolists, large compiled files that pair email addresses with passwords pulled from other, unrelated breaches, on the assumption that the same person may have reused a password somewhere else. That means even a breach with no passwords attached can still feed into credential stuffing attempts and account takeover down the line, especially if the same email later turns up in a leak that does include passwords.

How Database and Combolist Breaches Work

A combolist breach starts with an attacker pulling a batch of records directly out of a company's database, often by exploiting a security flaw in the website or its login system. Even when a leak contains nothing but email addresses, like this one from Negocios GT, it still has value on hacking forums because criminals routinely combine data from multiple breaches into a single combolist. Once combined with passwords sourced elsewhere, the merged list becomes a tool for testing stolen credentials against email providers, banking sites, and other services at scale.

Check If You Are Affected

You can check whether your email address shows up in this breach or any other by using HEROIC's free breach scanner, which searches a database of more than 400 billion leaked and breached records. If you find a match, stay alert for phishing attempts targeting that address and consider using a unique password for every account you own.