When the XSS.IS Combolist surfaced in February 2019 with 2.47 billion records, it became the largest single data breach ever indexed. What made this massive exposure particularly devastating wasn't just its size—it was that every single password was stored in plaintext, readable by anyone who accessed the data.
This wasn't an isolated incident. It's the norm.
The Staggering Scale of Plaintext Password Exposure
Across 27,409 documented breaches containing over 24.6 billion records, plaintext passwords appear in 23,339 distinct incidents—representing 85% of all tracked breaches. This isn't a problem from the early internet era that's been solved. Among the five largest breaches ever recorded, four exposed passwords in plaintext: XSS.IS Combolist, Misc Combolists (1.9 billion records), Ga$$Pacc Collection (518 million records), and AntiPublic (348 million records).
The message is clear: storing passwords in readable text remains the default for countless platforms, even when cryptographic hashing has been standard practice for over two decades.
Why Plaintext Storage Persists
You might assume that any developer building a login system in 2025 would know better. Yet the data tells a different story. Several factors explain this persistent vulnerability:
Developer shortcuts during rapid deployment. When startups and small platforms rush to market, password hashing often gets categorized as a "nice to have" rather than a foundational requirement. This technical debt frequently never gets addressed—until the breach happens.
Legacy systems never updated. The MySpace breach from 2008, containing over 301 million records, used SHA-1 hashing—at least it used some protection. Many platforms launched during the same era stored passwords in plaintext and simply never migrated to secure storage, even as they scaled.
Inadequate security knowledge. Analysis of breach types reveals that 15,304 incidents came from stealer logs—malware that extracts credentials from browsers and applications. While this isn't always plaintext storage in databases, it reflects a broader ecosystem where passwords move through systems unencrypted.
The combolist economy. The prevalence of combolists (6,298 breaches) creates a feedback loop. These are compilations of credentials from multiple sources, repackaged and redistributed. Their existence proves that plaintext passwords remain plentiful enough to fuel an entire underground market segment.
What This Means for Your Security
If your credentials appear in any of these plaintext password breaches, assume they're being actively tested against every account you own. Credential stuffing attacks—automated login attempts using leaked username/password combinations—succeed specifically because people reuse passwords across services.
Your exposure extends beyond the breached platform. When 1.9 billion email and password pairs circulate in plaintext (as in the Misc Combolists breach), attackers can test those credentials against banking sites, email providers, and corporate VPNs. A password exposed on a forgotten forum account from 2016 could compromise your primary email today.
The data never disappears. Once credentials leak in plaintext, they're copied, merged into larger collections, and redistributed indefinitely. The AntiPublic breach from December 2016 still circulates in underground forums eight years later, its 348 million plaintext passwords as useful to attackers today as when they first leaked.
Three Actions You Must Take
Check your exposure immediately. With over 24.6 billion records indexed, the statistical probability that your email appears in at least one breach approaches certainty. Visit LeakedSource to search your email addresses and understand which of your credentials have been exposed in plaintext.
Implement unique passwords everywhere. Password managers make it practical to maintain different credentials for every service. If one platform suffers a plaintext breach, the damage stays contained to that single account.
Enable multi-factor authentication universally. Even when your password leaks in plaintext, MFA prevents unauthorized access. Prioritize this for email, financial accounts, and any service that stores personal information.
The Bottom Line
The presence of plaintext passwords in 85% of tracked breaches isn't a technical mystery requiring advanced expertise to solve. Password hashing libraries exist for every programming language, and implementation takes minutes. This is a failure of priorities, not capabilities.
As long as platforms treat password security as optional, your credentials will continue appearing in massive plaintext collections like the XSS.IS Combolist. You can't control how services store your data, but you can control your exposure.
Find out which breaches contain your information at LeakedSource, where you can search over 24.6 billion records to understand your real risk profile. The breaches have already happened—what matters now is how you respond.