TL;DR: RockYou2024 was a file posted to a hacking forum on 4 July 2024 containing 9,948,575,739 unique plaintext passwords, compiled from older leaks. It's a combolist-style compilation: lists of passwords or email-and-password pairs gathered from many breaches and used to break into accounts automatically (credential stuffing). If you reuse passwords, assume yours is in one. Use unique passwords, a password manager and two-factor authentication.
What RockYou2024 was
Researchers at Cybernews found a file named rockyou2024.txt posted on a popular hacking forum on 4 July 2024 by a user called “ObamaCare,” TechRepublic reported. It held 9,948,575,739 unique plaintext passwords. Cybernews believed it combined the 2021 RockYou compilation (about 8.4 billion entries) with roughly 1.5 billion more, drawn from over 4,000 databases.
The name comes from RockYou, a company breached back in 2009 whose passwords became a standard list for password-cracking. Each new “RockYou” file is a bigger compilation, not a new hack.
So what is a combolist?
A combolist is a list of credentials, usually email-and-password or username-and-password pairs, gathered from many breaches and pastes and merged together. Some are sold; many are traded free on forums and Telegram channels. Newer ones are often built from stealer logs: passwords grabbed by malware straight from infected browsers.
RockYou2024 was mostly passwords without the matching emails, which makes it a wordlist for guessing. Combolists with email pairs are more immediately dangerous because they can be fired straight at login pages.
How criminals use them: credential stuffing
Attackers load a combolist into automated tools that try each pair on banks, shops, streaming and email sites. If you reused a password from an old breached site, the tool gets in. That's how many account takeovers happen without any “hack” of the site itself. Our explainer on account takeover fraud covers what follows.
Is my password in RockYou2024?
Don't download leaked files to check, and never type your password into a random “leak checker.” Instead:
- Check your email against known breaches. A free email exposure check does this in about 30 seconds, and here's how it compares with Have I Been Pwned.
- Use your password manager's built-in breached-password check.
- Assume any password you've used for more than one site is already in a list.
Our data page on breaches loaded into Have I Been Pwned since 2024 shows how often new combolists and stealer-log dumps appear.
What to do
- Stop reusing passwords. Start with email, banking and shopping accounts.
- Use a password manager to create and store unique passwords.
- Turn on two-factor authentication, ideally with an app or passkey rather than SMS.
- Check devices for malware if you're seeing logins you don't recognise, since stealer malware grabs saved passwords.
- Follow our checklist for what to do when a password leaks.
Frequently Asked Questions
What is RockYou2024?
A file posted to a hacking forum on 4 July 2024 containing 9,948,575,739 unique plaintext passwords compiled from earlier leaks, according to Cybernews researchers.
What is a combolist?
A compiled list of leaked credentials, usually email and password pairs, merged from many breaches and used to break into accounts automatically.
Was RockYou2024 a new hack?
No. It was a compilation of passwords from earlier leaks, including the 2021 RockYou file, plus about 1.5 billion more entries.
How do I check if my password was leaked?
Check your email against known breaches and use your password manager’s breached-password check. Don’t download leak files or type passwords into unknown sites.
What is credential stuffing?
Automated attempts to log in to many sites using leaked username and password pairs, which works when people reuse passwords.
Sources
- TechRepublic: Nearly 10 billion passwords leaked in biggest compilation of all time (July 2024)
- Have I Been Pwned