leaksear.ch metadata now ties the Vodafone dataset to a May 11, 2026 Lapsus$ source-code dump and an exposed CSV containing credential-style records. The leaksear.ch indexed count is 1,000 records, with email, username and password searchable and source_user_id stored.
A BestCombo/GGBestC credential stuffing list contains about 1.56 million plaintext email and password records advertised for popular gaming and streaming services. The data appears to be an aggregated combolist, not evidence of a direct breach at the named platforms.