Combolist vs stealer log vs database dump: what each one tells you

Combolist vs stealer log vs database dump at a glance

All three formats carry stolen credentials, and all three are traded in the same places. They differ in where the data came from, and that difference decides what a security team has to do next.

• A database dump is a copy of one service's user table, taken in a breach of that service.
• A stealer log is the output of malware on one infected computer: the sites the user signed in to, with the usernames and passwords typed there, and often more.
• A combolist is a list of email and password pairs assembled from many earlier sources, built for automated login attempts.

The table below sets them side by side. The sections after it explain each row with public examples.

Database dumps: one service, one point in time

A database dump is what leaves a company when its user database is stolen. The rows describe that company's users and nothing else. The LinkedIn entry on Have I Been Pwned is a standard example: 164 million email addresses and passwords exposed, originally hacked in 2012, and the data "remained out of sight until being offered for sale on a dark market site 4 years later". The passwords were stored as unsalted SHA1 hashes, and according to the same entry the vast majority were cracked within days of the release.

Two lessons follow. First, a dump can surface long after the breach, so the date you learn about it says little about the date it happened. Second, hashing does not end the risk. Weak storage turns a hashed dump into a plaintext one, and once that happens the passwords feed everything that comes after.

Dumps also tend to carry more than credentials. The Adobe entry lists internal IDs, usernames, email addresses, encrypted passwords and password hints stored in plain text. For an executive, those extra fields are often what makes the data useful to an attacker who never logs in at all. See hashed password and plaintext password for the storage terms.

Stealer logs: one device, every site on it

An infostealer is malware that copies data stored on a computer and sends it to the operator. Troy Hunt, who runs Have I Been Pwned, describes stealer logs as "the logs created by malware running on infected machines", and lists the usual ways in: a game cheat, a crack for pirated software, an executable someone was persuaded to run.

A stealer log differs from a dump in scope. Hunt notes that where a classic breach search returns breached services, stealer logs "contain a list of services that have never have been breached". The data describes what one person did on one machine, so a single log can hold a work single sign-on portal, a personal bank and a family email account side by side.

Microsoft Threat Intelligence documented what one widely used stealer collects. Its May 2025 analysis of Lumma Stealer states that the malware "extracts saved passwords, session cookies, and autofill data" from Chromium, Mozilla and Gecko-based browsers, and also targets cryptocurrency wallets, VPN and email client data, user documents and system details. Lumma was sold as malware as a service, with affiliates running their own campaigns. Our guide to what infostealer logs contain goes through each field. Saved passwords end up in a log in readable form: MITRE ATT&CK notes that browsers typically store credentials encrypted, but that methods exist to extract them as plaintext.

Session cookies are the field that changes the response. Microsoft's token theft playbook explains that in a token theft attack, threat actors "compromise and replay tokens issued to a user, even if that user has satisfied multifactor authentication". A password reset alone does not end that kind of access. The glossary entry on session cookie theft covers the mechanism.

The volumes are large. Have I Been Pwned records that in February 2025, 23 billion rows of stealer logs were obtained from a Telegram channel known as ALIEN TXTBASE, containing 284 million unique email addresses together with the websites they were entered into and the passwords used. Hunt's write-up adds that the channel gave away samples and sold subscriptions to newly obtained logs. In an earlier post on stealer logs he warns that the data "is prepared and sold by criminals who provide zero guarantees as to its accuracy". The website field matters on its own: our article on stolen credential paths shows how the login URLs in stealer logs map the supplier portals and third-party systems a company uses.

Combolists: reassembled and reposted

A combolist is a list of credential pairs, usually email:password or username:password, compiled for credential stuffing: trying each pair against other services in the hope the password was reused. Have I Been Pwned describes Collection #1, found in January 2019 on a hacking forum, as a large collection of "credential stuffing lists (combinations of email addresses and passwords used to hijack accounts on other services)". It held almost 2.7 billion records and 773 million unique email addresses. The forum post behind it advertised "dehashed" databases, which Hunt explains as passwords that were cracked and converted back to plain text. Combolist passwords are often in this state, because a list built for login attempts is only useful when the passwords can be typed.

The lines between the formats blur here. Combolists are built from dumps and stealer logs. The Have I Been Pwned entry for combolists posted to Telegram, collated in May 2024, covers 2 billion rows with 361 million unique email addresses across about 1,700 files. It says the data "appears to have been sourced from a combination of existing combolists and info stealer malware", and that many rows included the website the credentials were entered into.

That is why the same credentials keep reappearing. A combolist row has usually lost its origin by the time it is reposted, and the next list is assembled from the last one. Our article on why the same data keeps reappearing follows that cycle in detail.

What each finding means for an executive

When an executive's credentials turn up, the first question is which of the three formats they came from.

• In a database dump. The executive used that service, and the password they used there is exposed or crackable. The risk sits in reuse. Reset that password on every account where it was used, starting with email and anything that controls payments.
• In a stealer log. Something the executive used was infected. Treat the device as compromised: rebuild or reimage it, revoke active sessions for every account in the log, and reset every password saved in that browser. Work and personal accounts both count, because the log does not separate them.
• In a combolist. The pair is circulating and will be tried against other services. Check whether that password is still in use anywhere. If it is, reset it. If it was retired years ago, record the finding and move on.

In all three cases, one control from NIST applies: SP 800-63B-4 says a new password "SHALL" be compared against a blocklist of known commonly used, expected or compromised passwords, and gives "passwords obtained from previous breach corpuses" as an example of what that list may include.

How WebThreat covers dumps, stealer logs and combolists

The two WebThreat products look at this data from different ends.

EDG3 watches the channels and communities where stolen data, stealer logs and combolists are posted and sold, including dark web forums and marketplaces, Telegram and other channels, and leak databases. It links reposted copies of the same leak and keeps the provenance of each one: where it was first posted and who is selling it.

CEM starts from a company's executives and checks them against breach corpora and leak databases. It shows which credentials and personal data fields are exposed for each person and ranks the findings by what to fix first, using the factors set out in the methodology. For how these sources reach the market in the first place, see how stolen data is sold.