Your Xbox Login May Be Compromised. This Combolist Exposed 3 Accounts.

What HEROIC Analysts Found

In July 2026, HEROIC analysts identified a small combolist file labeled "xbox," uploaded to a Telegram channel. The file contained just 3 records, each pairing an email address with a plaintext password and the URL of the login page it belongs to.

Why This Is Dangerous

Three accounts is a small number, but the danger for the people involved is not. The file's name suggests these are Xbox or Microsoft account logins, which can be tied to saved payment methods, purchased games, and linked friends lists. With the password already in plain text and the login page identified, an attacker can sign in immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each login to the site it belongs to

Why This Matters

A gaming or Microsoft account often connects to a stored payment card, purchase history, and sometimes linked social or email accounts. If the same password is reused elsewhere, which is common, an attacker could pivot from this login into email, banking, or shopping accounts through credential stuffing. Size does not determine risk here, exposure does.

How Combolists Work

A combolist is a compiled file of email or username and password pairs, usually assembled from earlier breaches, stealer logs, or leaked databases. Small files like this one, focused on a single service such as Xbox, are often carved out of a larger source list so a buyer can target one type of account specifically.

Check If You Are Affected

Whether a leak involves 3 accounts or 3 million, checking your exposure is worth a minute. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to tell you if your email address has surfaced in this leak or others.