145 Records Leaked From XSplit_BF, Plaintext Passwords Exposed

A small combolist file tied to XSplit_BF surfaced with 145 records, dated 17-Mar-2026. It contains email addresses, plaintext passwords, and the URLs linked to each account. Though the count is small, every record in it pairs a working password with an email address in plain, readable text. The only way to know for certain if your information is part of this file is to scan your email.

Why Size Doesn't Make This Less Dangerous

A file with only 145 records is just as usable to an attacker as one with millions, since every single record still contains a working email and password pair. Because the passwords here are stored in plaintext, they can be used to log in immediately, with no cracking step in between. If your XSplit password shows up in this file, treating it as compromised right now is the safer assumption.

What's Inside This Record Set

• Email addresses: identify you and can be used to log in wherever you use that address as a username.
• Plaintext passwords: usable exactly as written, no decoding required.
• URLs: show which login page each credential pair is meant for.

The Risk of a Reused Streaming Password

People often reuse a password across a streaming or gaming account and something more sensitive, like email or a shopping account. If that's the case here, an attacker who tests this XSplit_BF password elsewhere could gain access to accounts that have nothing to do with XSplit. That kind of password reuse turns a small file into a much larger exposure.

How a File Like This Gets Compiled

Combolists like this one are built by pulling email and password combinations together from different places and packaging them so they can be tried against other sites. The presence of URLs in this file points to whoever built it tracking the login page tied to each credential pair. Even a small file like this can keep resurfacing in different corners of the internet long after it was first put together.

What to Do About the XSplit_BF Records

Use the scan your email tool to check whether your address is one of the 145 in this file. If it is, change your XSplit password along with any other account sharing that same password, and pick something unique for each one going forward. Check this on both your personal and work email, since either could be the one listed.