Data leaks of this magnitude usually originate from or database breaches . When a major service is compromised, hackers aggregate the data into "combolists." These lists are then traded or sold on the dark web.
"Mix" suggests the credentials come from multiple different website breaches rather than a single source. "Zip" refers to the compressed file format. Risks and Security Advice 346k mail access valid hq combolist mixzip new
: This suggests that the data includes valid email addresses along with their corresponding passwords or access details. Data leaks of this magnitude usually originate from