Breach Dump, Combolist, Stealer Log: Three Different Leaks, Three Different Risks

“Your email was found in a data breach.”

One sentence, three very different situations. Your right next move depends on which one you actually landed in, and the notification usually does not say. Ours tags every result, because the tag changes what you should do next.

Here are the three kinds of leaks, with real examples from our catalog, and the playbook for each.

1. The breach dump: one site’s database

The classic. Someone breaks into one service and walks off with its user database. Emails and passwords, hashed if you are lucky. Plus whatever else that service knew about you, from birth dates to home addresses.

Wattpad sits in our index with 268 million records from its 2020 incident. Deezer follows at 244 million. And fresh ones keep landing, like Paidwork with 23 million this July. Each is one company, one incident, one dataset.

What it means for you: the account you had on that service is exposed, plus any other account sharing that password.

The playbook: change the password on the breached service. Then comes the step everyone skips: changing it everywhere else that password lived. And read exactly what got out, because ID numbers and home addresses ask for different responses than a password does. Our results list the exposed data types per breach. And while you are in the settings anyway, switch on two-factor authentication; it turns the next leaked password from an emergency into a non-event.

2. The combolist: recycled ammunition

A combolist is not a new breach. It is a compilation. Someone scraped email-and-password pairs out of many older breaches, deduplicated them badly, and repackaged the pile to feed credential stuffing, the automated login attack.

Our index holds two giants of this kind. Collection-1 surfaced in 2019 with about 790 million records. AntiPublicCombo goes back to 2016 with 457 million. Almost nothing in either was new when it appeared. The danger is the packaging, not the freshness.

What it means for you: some password of yours, possibly from years ago, now sits in a file that attack tools will mechanically try against hundreds of services. The question is not “which site lost it” but “where else does that password still work?”

The playbook: stop reusing passwords; a password manager makes unique-everywhere the default rather than a discipline. If a combolist hit surprises you, treat it as a prompt to rotate anything old and shared. Forgotten accounts count too: if the service still exists, the password still works. There is no single service to blame or fix.

(Not sure which of these you are in? Ten seconds settles it: xposedornot.com. Every result carries its type.)

3. The stealer log: one device’s everything

The newest and least understood. Infostealer malware on an infected device scrapes what the browser holds: every saved password, autofill entries, and active session cookies. One victim, everything, in a single file.

Real example from our index: AlienStealerLogs (just under 300 million records, announced in June), our first stealer-log source. It comes with a caveat worth knowing: researchers who analyzed the underlying collection found it padded with recycled older data, so a hit here is a signal to investigate, not proof of infection.

What it means for you: a device that held your logins may have been infected. Session cookies mean attackers can sometimes skip passwords and MFA entirely.

The playbook (order matters): scan your devices first. Sign out of all devices on key accounts, which kills stolen sessions. Then rotate passwords, from a device you trust. If the scan comes back clean and the credentials in the log are years old, you were probably in the recycled portion.

The same email, three different emergencies

Put side by side:

Three tags, three playbooks. This is why we label results instead of just saying “found.” A wrong label sends you to the wrong fix, and the wrong fix feels safe while fixing nothing.

How do I know which one I am in?

Run your email through the search and read the result cards. A conventional breach shows the service’s name and what that service leaked (the Wattpads and Paidworks of the world). A compilation shows up under the collection’s name, Collection-1 style, usually with just emails and passwords listed, because that is all a combolist is. A stealer-log source carries the explicit “Stealer Logs” tag, and that tag should send you to the device-first playbook above rather than the change-your-password reflex.

If a result confuses you, the catalog entry behind it is public: every breach’s type, date, and exposed data classes are queryable on the free API, no key needed.

Check what your email is actually in, free, no signup: xposedornot.com. Every result carries its type.

And if the labeling approach makes sense to you, drop us a star on GitHub. It helps others find the project, and honestly, it makes our day.

Appendix: Sources and references

• All named datasets and record counts: our public catalog, queryable keyless at api.xposedornot.com/v1/breaches (breach_id: Collection-1, AntiPublicCombo, Wattpad, Deezer, Paidwork, AlienStealerLogs)
• Credential stuffing mechanics: OWASP
• Stealer-log padding analysis: ALIEN TXTBASE deep analysis (Infostealers.com)
• Our stealer-log announcement: blog.xposedornot.com/introducing-stealer-logs-alienstealer