Alleged PayPal Credential Leak: 104K Email and Password Combinations Exposed
🧩 Standalone API Access Now Available
Access high-volume threat-intelligence data, automated ingestion endpoints, ransomware feeds, IOC data, and more – independently from the above standard subscriptions.
View API AccessUnlock Exclusive Cyber Threat Intelligence
Powered by DarkWebInformer.com
Foundational access to breach intelligence. Track breaches, leaks, and threats in real time with high quality screenshots and concise expert summaries.
Continuously updated breach reports and threat summaries.
Daily breach, leak, and DDoS alerts.
Live tracking with JSON export.
Direct access to claims and posts.
Concise summaries of DDoS, defacements, and breaches.
Verified index of dark web sites and services.
Live status of 500+ sites.
Integrated checks inside breach posts.
Uncompressed, watermark free evidence.
Browser alerts for tracked terms.
Quick Facts
Incident Overview
A threat actor using the handle "Lud" posted on a popular forum on January 11, 2026 claiming to be sharing approximately 104,000 PayPal user credentials in a combo list format (email:password). The threat actor states this data is from December 2025 and claims nobody has shared it before.
- Data Format: Email:Password combo list
- Record Count: Approximately 104,472 lines
- Alleged Date: December 2025
- Distribution: Free share on the forum
- Sample Data Visible: Multiple email addresses with associated passwords shown in screenshot
- Archive Links: Multiple file hosting services (MEGA, Gofile, Pixeldrain)
Indicators of Compromise (IOCs)
No IOCs were disclosed by the threat actor in this claim.
Breach Claim URL
Image Preview
Unlock Exclusive Cyber Threat Intelligence
Powered by DarkWebInformer.com
Foundational access to breach intelligence. Track breaches, leaks, and threats in real time with high quality screenshots and concise expert summaries.
Continuously updated breach reports and threat summaries.
Daily breach, leak, and DDoS alerts.
Live tracking with JSON export.
Direct access to claims and posts.
Concise summaries of DDoS, defacements, and breaches.
Verified index of dark web sites and services.
Live status of 500+ sites.
Integrated checks inside breach posts.
Uncompressed, watermark free evidence.
Browser alerts for tracked terms.
Dark Web Informer © 2026 | Cyber Threat Intelligence
