MyRecon OSINTCombolists Posted to Telegram
On 28 May 2024, Combolists Posted to Telegram was breached. 361,468,099 accounts were exposed, including email addresses, passwords, usernames. MyRecon rates it 83/100, critical. That is roughly everyone in the United States.
The detail that sets this collection apart from an ordinary password dump is in the description: in many cases the records include the website the credentials were entered into. That turns a list of email-and-password pairs into a targeting list, an attacker no longer has to spray a credential across a hundred services hoping for a match, because the file already says where it worked.
The other half of the source is information-stealing malware, which changes what the data means for the person in it. Credentials harvested from an infected device were captured as they were typed. They can include accounts at sites that have never been breached, passwords created after every previous breach notification, and sessions from a browser's saved-password store in one sweep.
So the honest read of an appearance here is: your password is known, possibly with the site it belongs to, and possibly because a machine you used was compromised rather than a company you trusted. Clean the device first if there is any chance it was the source. Then rotate credentials in order of what they can unlock, email before everything, because email resets everything.
The story behind the breach
In May 2024, 2B rows of data with 361M unique email addresses were collated from malicious Telegram channels . The data contained 122GB across 1.7k files with email addresses, usernames, passwords and in many cases, the website they were entered into. The data appears to have been sourced from a combination of existing combolists and info stealer malware.
Breach description from Have I Been Pwned, used under a CC BY 4.0 licence.
How did it happen?
The data appears to have been sourced from a combination of existing combolists and info stealer malware.
What was the motive?
The published account does not establish the motive. We cannot tell what the attackers intended from the exposed data alone.
Reported demands or attempts to sell data describe what happened, rather than prove every attacker's intention.
What was the outcome?
361,468,099 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.
The reported exposed data includes Email addresses, Passwords, Usernames.
What was exposed, and why it matters
- Email addressesThe address becomes a confirmed, active target, expect more phishing, better aimed.
- PasswordsAnyone reusing this password elsewhere has those accounts exposed too, credential stuffing is automated and tries them all within days.
- UsernamesA handle links this account to every other place the same handle is used.
What to do if you were in it
- Change this password anywhere you reused it, starting with your email account, that is the one that can reset all the others.
- Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this.
Questions people ask about this breach
Was my email address in the Combolists Posted to Telegram breach?
Use the email box on this page. The result applies only to this incident. If the provider does not cover this breach, we say so. A missing match does not prove you were unaffected.
What data was leaked in the Combolists Posted to Telegram breach?
email addresses, passwords, usernames. Each one is explained above, along with what it means for the person it belongs to.
When did it happen, and when did it become public?
The breach is dated 28 May 2024. It was published to Have I Been Pwned on 3 June 2024, a gap of 7 days during which the data was already out.
Is the Combolists Posted to Telegram breach real?
Yes. Have I Been Pwned lists it as verified, meaning the data was checked against the source rather than taken on trust.
How many people were affected?
361,468,099 accounts. That is roughly everyone in the United States. That is accounts rather than people, one person often has several.
Read next
Also in the archive
Case Files: how the landmark breaches actually happened →
Three kinds of content appear on this page and they are kept apart deliberately. The breach description is quoted from Have I Been Pwned under its licence. The severity score, the field-by-field explanation and the advice are computed from the record itself, every sentence derives from a number or a flag in it, which is what stops the analysis drifting from the evidence. Anything under the "MyRecon's take" byline is editorial: our reading of this breach, presented as opinion rather than as a finding.