What is a combolist, and why the same data keeps reappearing

What a combolist is

A combolist is a list of stolen login pairs. Troy Hunt, who runs the breach notification service Have I Been Pwned, defines combolists as "combinations of email addresses or usernames and passwords". Each line holds one pair, usually in the form email:password or username:password. Newer lists often add the website the login belongs to, in the form website:email:password, which often points to infostealer malware as the origin. The glossary entry on ULP lists covers that format.

Combolists exist for credential stuffing. The OWASP cheat sheet on the attack defines it as "testing username/password pairs obtained from the breach of another site". The attack works because of password reuse: a pair stolen from a small shopping site is worth something only if the same person used the same password for email, a bank or a work account.

Where combolists come from

A combolist has three typical inputs.

1. Breach dumps. A database stolen from one service, with passwords that were stored in plain text or cracked from weak hashes.
2. Stealer logs. The output of malware on infected computers, with every login the browser saved. See stealer logs.
3. Earlier combolists. Lists are merged, cleaned, split by email provider and reposted.

Public datasets show all three. In January 2019 Hunt analyzed Collection #1, a set found on a cloud storage service and discussed on a hacking forum. The forum post described it as "a collection of 2000+ dehashed databases and Combos stored by topic". It held 2,692,818,238 rows and 772,904,991 unique email addresses, "made up of many different individual data breaches from literally thousands of different sources".

The Naz.API list, which Hunt analyzed in January 2024, had 319 files totaling 104GB and 70,840,771 unique email addresses. It mixed stealer logs with what Hunt calls "classic credential stuffing username and password pairs". The largest file alone held 312 million rows of email addresses and passwords.

In June 2024 Hunt loaded a set scraped from Telegram: 1,748 files from 518 channels, about 2 billion lines and 361 million unique email addresses. Many rows carried the website the credentials were typed into, which he describes as looking very much like infostealer output. When he checked one person's earlier breaches, most of them hashed, he asked whether those passwords had been cracked and used to create new lists. His answer: "Very possibly."

Why the same data keeps reappearing

Because each list is built partly from earlier ones, much of a new combolist is old data. Have I Been Pwned's checks of three large lists show how much.

Everything else in those sets had been seen before. In the Telegram set, subscribers who helped Hunt verify the data recognized details that had leaked in earlier breaches; his summary of one case was "So accurate, but not new". He also describes how Collection #1 was followed quickly by Collections #2 through #5 and more, which he called "a race to the bottom". Against that background, he treats a genuinely new list as an exception to "the usual collection of repurposed lists wrapped up with a brand-new bow on it and passed off as the next big thing".

Three habits of the trade keep the cycle going:

• Lists are rebuilt from lists. A new combolist starts from older ones and adds whatever new rows the seller has.
• Data moves between venues. Collection #1 sat on a cloud storage service while it circulated on a hacking forum. The Naz.API list was posted to a hacking forum but, by Hunt's account, was apparently sourced from a now defunct lookup website.
• Old data is passed off as new. Hunt's "brand-new bow" line describes this, and Kaspersky notes that Telegram lacks the reputation systems of dark web forums and that many scammers there deceive other members. Our look inside Telegram cloud channels found much of the data on sale recycled under new names.

Old credentials still work

A recycled row is not automatically harmless. Mandiant's June 2024 report on the campaign against Snowflake customer instances found that most of the credentials the attacker used came from historical infostealer infections, "some of which dated as far back as 2020". At least 79.7% of the accounts used had prior credential exposure. The accounts had no multifactor authentication, and in many cases the credentials had not been rotated for as long as four years.

The data was old, but the passwords still worked, and that is what turned recycled credentials into an incident.

How to read a combolist hit

When an employee's or executive's address shows up in a combolist, work through four questions.

1. Is the password still in use anywhere? If it is, change it everywhere it was used, starting with email and anything that controls money. NIST SP 800-63B-4 says verifiers "SHALL force a change if there is evidence that the authenticator has been compromised", and lists "passwords obtained from previous breach corpuses" as an example of what a password blocklist may include.
2. Does the row name a website? A website:email:password row usually comes from a stealer log, which points to an infected device and possibly stolen sessions. The comparison in combolists vs stealer logs vs database dumps explains the different responses.
3. Is it new or a copy? Compare the row with leaks you already know about before treating it as a fresh breach.
4. Is multifactor authentication on? The OWASP cheat sheet calls it "by far the best defense against the majority of password-related attacks".

How EDG3 handles reposted copies

EDG3 watches the channels and communities where stolen data, stealer logs and combolists are posted and sold, including dark web forums and marketplaces, Telegram and other channels, and leak databases. It compares the contents of each file with everything it has collected, so a dump that is renamed, repackaged or resold still traces back to the data it came from. It links reposted copies, keeps the provenance of each one and shows how much the copies overlap. That is how EDG3 tells a recycled list from new data, and it writes a cited assessment for your domain once the owner authorizes it.

For the executive view, CEM checks a company's executives against breach corpora and leak databases and shows which credentials and personal data fields are exposed. For how combolists reach buyers in the first place, see how stolen data is sold.