: Possession or distribution of stolen credential lists is illegal in many jurisdictions.

: Attackers feed these files into automated tools to test stolen credentials across multiple websites, exploiting the fact that many users reuse passwords.

: These lists are "compilations of multiple breaches" (COMBs). They aggregate data leaked from various historical security incidents into a single file.