Check Now
Breach research

AntiPublic Combo List: 457M Emails Still Fuelling Attacks

November 4, 2026
Anti Public: 457M logins, still in play. A 2016 list, a 2026 problem. Thousands of paper slips stream down into one grey folder on a dark blue ground.

Nobody broke into a company called Anti Public. There’s no such company. The Anti Public combo list is a file. 457 million email addresses, each with at least one password, pulled out of older breaches and stitched together so attackers could try the pairs on other websites.

It started going round in December 2016. The first public analyses landed in May 2017. And in October 2026, nearly ten years on, it’s still the #5 entry by records in our index, so it turns up in a lot of checks.

So this is the file’s story. What’s in it, where it came from, why a decade-old password list still opens accounts, and what to do when “Anti Public Combo” turns up in your result.

A word on who’s writing. I run XposedOrNot, a free, open-source breach checker: type in an email, see which public breaches it’s in, no signup, nothing stored. The first-party numbers below come from our catalog of 796 breaches and 11,717,192,990 records, pulled on 28 October 2026.

Anti Public combo list: the facts

Name in our indexAnti Public Combo
In circulation fromDecember 2016
First public analysesMay 2017
Records in our index457,399,902 email addresses, each paired with one or more passwords (records, not people: one person can own several addresses)
Data exposedEmail addresses, passwords
Password storagePlain text
TypeCombo list: a compilation, not a single-site breach
Rank by records#5 of 796 breaches, as of 28 October 2026
Added to our index8 November 2023
Shows in a free email checkYes

What is a combo list?

A combo list is a text file of login pairs, one per line, usually in the shape email:password. Nothing was hacked to make it. Someone gathered passwords that had already leaked from many sites, matched each to its email address, and saved the lot as one file.

Its value to an attacker isn’t freshness (the data almost never is fresh). It’s that the pairs are ready to feed into software. The tool tries each one against a streaming service, a payment app, your email provider and a few hundred shops, then reports back which doors opened.

The attack is called credential stuffing, and the list is its ammunition.

We compared a combo list with a breach dump and a stealer log in an earlier post. In one sentence: a breach is one site losing its database, and a combo list is a pile of those, sorted for attack.

What a combo list looks like inside: email and password pairs, one per line, assembled from many earlier breaches and fed into a credential stuffing tool

Where the Anti Public list came from

Two large files surfaced within weeks of each other in late 2016. The first, in October, was tied to Exploit.in, a hacking forum, and holds 592,919,058 addresses in our index. The second was Anti Public, passed around from December.

Both sat on forums for months. The first public report came on 5 May 2017, when Hackread put the unique addresses at about 458 million, with roughly 222 million of them also in the Exploit.in file.

Six days later came Duo Labs’ analysis of 562 million username and password pairs from the file, reported by Threatpost. (The pair count runs higher than the address count because many addresses carry several passwords.)

Where had the passwords come from? Duo traced parts of the file back to Adobe, Dropbox, LinkedIn, Yahoo and VerticalScope, plus “many others”. Familiar names.

Timeline of the Anti Public combo list from the October 2016 Exploit.in file to the May 2017 analyses, our indexing in November 2023 and checks in October 2026

Our catalog shows how much raw material was lying about. It holds 206 single-site breaches dated before December 2016 that leaked passwords, with 1,685,534,475 records between them.

And 156 of those 206 sites had stored the passwords in plain text or in hashes that crack in minutes (45 plain text, 111 weak hashing). Only 27 used strong hashing, and 23 we can’t classify.

LinkedIn alone lost 160 million in 2012. Adobe followed with 152 million the next year. Dropbox’s 69 million from 2012 only surfaced in 2016.

All three are on Duo’s list of sources. Anti Public is what you get when someone tidies that pool into a single file.

The ten biggest password-leaking breaches dated before December 2016 in our catalog, coloured by how the passwords were stored

How much of a breach index is compilations?

More than people expect. Six aggregate files in our catalog (Anti Public, Exploit.in, Collection #1, the 2017 “1.4 billion” file, Pemiblanc and Naz.API) hold 3,140,506,502 records between them. That’s 26.8% of everything we index as of 28 October 2026, from six entries out of 796.

Six aggregate files hold 26.8% of the 11.7 billion records in our catalog; the other 790 breaches hold the rest

This is why breach totals from different services rarely match. Count the compilations and the number balloons; leave them out and it drops by a quarter.

We count them, because you need to know whether you’re looking at a fresh break-in or a recycled one. Five of the six carry the combo list type in the catalog (Exploit.in is still typed as a breach, a label we’re looking at), and our ranking of the largest breaches says the same thing in its opening: four of the top five are compilations.

Does a recycled file matter less, then? For the site that lost the data originally, maybe. For you, no, and the next section is why.

Why a 2016 password list still works in 2026

Because the password in it is probably still in use somewhere. That isn’t a hunch; it’s been measured, more than once, on real accounts.

The largest study I know of is by Wang and colleagues at Virginia Tech, published at ACM CODASPY in 2018: 28.8 million users, 61.5 million passwords, 107 services, eight years of leaks. 52% of users had reused or lightly modified a password across services. More than 70% were still using an already-leaked password on another site a year after the leak. 40% were still using one leaked more than three years earlier.

A Google and Berkeley team measured it from the other side at ACM CCS in 2017, across 1.9 billion credentials exposed through third-party breaches between March 2016 and March 2017, the window Anti Public appeared in. For 7% of the people caught in those breaches, the password in the file was still their current Google password. Small share, enormous pool.

The attackers’ side has numbers too: Verizon’s 2025 DBIR research found credential stuffing made up a median 19% of all daily login attempts across two years of single sign-on logs, and 44% on the worst day.

Its 2026 report, published 19 May 2026 across more than 22,000 confirmed breaches, has credential abuse down to 13% of first entries. Software vulnerabilities overtook it, at 31%. Count it at any point in the breach, though, and it’s still the top action at 39%.

Four measured reasons an old password list still works: reuse rates, the Google match rate, and the share of login traffic that is credential stuffing

So the file is old, and your habits are what keep it current. If any password you used in 2016 or earlier is still live on any account, a list like Anti Public is where that password gets tried. In our experience the forgotten accounts are where it bites, which is why we wrote a guide to finding and closing them.

What the passwords inside looked like

Duo’s 2017 breakdown is a snapshot of 2016 habits. 70% of the passwords had at least one digit, only 6% had an uppercase letter, 4% had a symbol, and length peaked at nine characters. Kyle Lady, the Duo engineer behind the analysis, put it drily: “It took us this long for 70 percent of people to start using a digit in their password.” Drily, and fairly.

The sites were no better than their users. Of the 518 breaches in our catalog that leaked passwords, 289 (56%) stored them in plain text or in hashes weak enough to crack at scale, as of 28 October 2026. We broke that split down in September.

A nine-character password with a digit on the end, stored as an unsalted hash in 2013, was as good as plain text by 2016. Anti Public is full of exactly those. If one of yours fits that description, step 3 below is the ten-second way to find out whether it’s already in a file like this.

“Anti Public Combo” is in my check. Now what?

Run the free check first if you haven’t. The result lists each breach by name with the password risk beside it.

If Anti Public is there, do these in this order. The order matters more than the speed.

  1. Work out which password it was. We never store or show passwords, so start from the date. Anything you used in 2016 or earlier, on any site, is a candidate. The sources named above are a good memory jog.
  2. Change that password everywhere it still lives. Not only on the site that lost it. On every account where you reused it or used a near copy. Wang’s team found 30% of “modified” passwords fall within ten guesses. Summer2016 to Summer2017 doesn’t count as a change.
  3. Check the new one isn’t already out there. Our password check tests it against 835 million+ leaked passwords without the password leaving your browser (only a partial hash does). NIST’s current guidance asks websites to run this screening for you. In our experience, most sign-up forms still don’t.
  4. Turn on two-factor authentication, email first, then banking, then anything with a card stored. A stuffed password meets a second lock it can’t open.
  5. Set up alerts so the next file doesn’t surprise you. Alert Me on XposedOrNot is free. We do the monitoring, it sends you the notification when your address appears in a newly indexed breach.
  6. Prune. If a site from 2016 still holds your account and you don’t need it, close it. Fewer accounts, fewer places for an old password to live.
The six steps in order when Anti Public Combo appears in your breach check

Run a domain you own? The same catalog sits behind free domain monitoring. Verify the domain once and you’ll see which breaches touch addresses on it, Anti Public included.

If the domains you watch belong to clients rather than to you, that’s the paid line, xonThreatIntel+.

And if you’d rather your address didn’t appear in anyone’s public search at all, Privacy Shield takes it out of ours.

Why our page says “Verified: No”

Fair question, given the file is plainly real. Our methodology page says an entry is verified when the organisation that lost the data acknowledged it, or the media covered that incident. A compilation has no organisation behind it, and the 2017 coverage is about the file, not about any one site losing its database.

So the flag stays off, and the combo list type does the explaining instead. It’s a note on where the file came from, nothing more; the addresses in it are as real as any other entry. (The industry label on that page is a catalog field we’re correcting, since a compilation has none.)

FAQ

What is the Anti Public combo list? A file of about 457 million email addresses paired with passwords, assembled from older breaches and circulating among attackers since December 2016. It’s a compilation built for credential stuffing, not a break-in at any one company. It sits at #5 by records in our catalog of 796 breaches as of 28 October 2026.

Was Anti Public a real data breach? Real data, no single event. Every pair in it leaked from somewhere else first (Adobe, Dropbox, LinkedIn and Yahoo were among the sources named in 2017), then someone merged the lot into one list, which is why our catalog tags it as a combo list and shows no company or domain.

Which of my passwords was in the Anti Public combo list? We can’t say, because we never keep passwords. What we do have is the date, so start there: the LinkedIn, Adobe and Dropbox leaks that fed this file are all from 2012 and 2013, and whatever you used on those sites back then is the first thing to change. Then run the replacement through the free password check.

Should I still worry about a 2016 combo list in 2026? Only if a password you used back then is still in service somewhere, and the research says that’s common: 40% of users in one eight-year study were still reusing passwords leaked more than three years earlier. If you’ve rotated everything since and use two-factor authentication, an Anti Public hit is old news you’ve already dealt with.

Since we indexed this file in 2023, the pattern hasn’t changed once: someone finds it in their result, remembers a password they’d forgotten, and realises it’s still working on an account they’d forgotten too. Fix that one thing today.

And if this was useful, drop a star on the GitHub repo, since it helps other people find the project and, honestly, still makes our day.

Appendix: Sources and references

Get alerted when your email shows up in a new breach. Set up free breach alerts, it takes two minutes.

Check out some of our posts for you.

Facebook Twitter Linkedin Mastodon
| © 2026 XposedOrNot.com.