Anti Public Combo List Data Breach (2016): What Was Exposed & What To Do

In December 2016, a compilation containing 458 million unique email addresses paired with passwords appeared online under the name “Anti Public.” The list aggregated credentials drawn from earlier incidents at multiple online services and quickly circulated among attackers who used it for automated login attempts on other sites. The incident highlighted how reused passwords can extend the reach of earlier breaches long after the original compromises occurred.

Breaking down the breach

The list surfaced publicly on December 16, 2016. It contained 458 million unique email addresses, with many addresses accompanied by multiple passwords that had been obtained from separate online systems. No single organization was identified as the source; instead, the compilation aggregated data from prior, unrelated incidents. The list was distributed in a format commonly called a “combo list,” intended for bulk testing of username-password pairs.

How a breach like this happens

Combo lists are assembled by collecting credentials that have already been exposed in separate data incidents. Once gathered, the pairs are often deduplicated by email address while retaining every associated password. Attackers then run automated scripts that submit these pairs against login pages of unrelated services, a technique known as credential stuffing. Success depends on users having reused the same password across different accounts.

Anti Public Combo List and its sector

Anti Public was not a conventional company or service but a large-scale compilation of login credentials. Such lists circulate in underground forums and file-sharing channels where participants trade or sell aggregated breach data. Their value lies in scale: even if many individual entries are outdated, the volume increases the chance that some pairs remain valid on other platforms.

What data was at risk

The exposed records consisted of email addresses and passwords. The compilation did not include additional personal details such as names, addresses, or payment information. Because the list drew from multiple earlier incidents, the exact origin of any individual entry remains tied to those prior, separate events rather than a single new compromise.

Why it matters

When large numbers of email-password pairs become widely available, attackers can test them against many different websites with little cost. Accounts that share passwords across services face the highest risk of unauthorized access. Organizations that later experience login attempts from unfamiliar locations or devices may trace activity back to lists of this kind.

If your data was in this breach

Change passwords on any accounts that still use credentials matching those that appeared in older compilations. Enable multi-factor authentication wherever available, and avoid reusing passwords across different services. Readers can check whether their email address appears in known breach data by running a free exposure scan on a site that aggregates public breach records.

AICompiled with AI assistance from public sources and published under our editorial standards.