How the YAHOO NEW 0804 Combolist Leaked 929,803 Passwords

A 929,803-Record Combolist Tied to Yahoo Accounts Surfaces

HEROIC analysts identified a combolist file labeled "YAHOO NEW 0804," uploaded to a Telegram channel and dated March 23, 2023, containing 929,803 records. Each entry pairs an email address with a plaintext password and a corresponding URL, and the file's naming suggests it was compiled to target accounts linked to Yahoo services.

Why This Is Dangerous

With close to a million email and plaintext password pairs in a single file, attackers have everything they need to attempt direct logins at scale. Because the passwords are not hashed or encrypted, there is no cracking step involved, and the paired URLs point straight to the correct login page for each account, making mass automated login attempts fast and cheap to run.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to the accounts

Why This Matters

A combolist of this size is valuable precisely because of its scale. Criminals load lists like this into automated tools and run credential-stuffing attacks against email providers, banks, and online retailers, testing whether the same password was reused elsewhere. Given that this list is nearly 930,000 records deep, even a small percentage of reused passwords translates into thousands of successful account takeovers, identity theft cases, and fraud attempts.

How Combolists Like This Are Built

A combolist is a plain-text file of "combo" entries, typically an email or username paired with a password, sometimes with a target URL added to speed up automated login attempts. Combolists like this one are usually assembled from older breach data, phishing hauls, or malware infections, then re-labeled and packaged around a specific target, in this case, accounts associated with Yahoo. Once assembled, they are distributed on Telegram channels and dark web forums where other criminals can access them cheaply or for free.

Check If You Are Affected

Given the scale of this combolist, checking your exposure is worth the two minutes it takes. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including large combolists like this 929,803-record file, so you can see if your email and password combination is circulating and update your credentials before someone else uses them.