722 Passwords Sat Exposed for Weeks in X722 MIX Telegram Leak

HEROIC analysts found a combolist labeled "X722 MIX" that had been sitting on Telegram since it was uploaded on 20 August 2026, containing 722 records of email addresses paired with plaintext passwords and the URLs those logins were used on. By the time it was flagged, the file had already been available for anyone to download.

Why This Is Dangerous

Every day a file like this remains online, more people can download it and start testing the credentials inside. Because the passwords are stored in plaintext, there is no delay between downloading the file and attempting to log in with each pair, which means the window between upload and misuse can be very short.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs (the sites the credentials were originally used on)

Why This Matters

The longer a combolist circulates, the more copies get made and the more attackers gain access to it, expanding the pool of people who can attempt credential stuffing against banks, email providers, and shopping sites. Reused passwords among these 722 records could lead to account takeover, identity theft, or financial fraud for the people affected.

How Combolists Work

A combolist is a plain text file pairing emails or usernames with passwords, typically compiled from older leaks, phishing pages, or malware infections and merged into a single file. Once uploaded to a Telegram channel, it can be copied, forwarded, and reposted indefinitely, which is why acting quickly after a leak is discovered matters.

Check If You Are Affected

Use HEROIC's free breach scanner to check whether your email address appears in this combolist or in any of the over 400 billion breached records in HEROIC's database. If your credentials show up, change that password right away and enable two-factor authentication wherever it's available.