1,130,241 Records Exposed in Private EDU Combolist Leak

HEROIC threat analysts identified a large combolist named "1_3M_PRIVATE_EDU_COMBOLIST_MIX_COUNTRY_June_2026" uploaded to Telegram on 27 June 2026. The file contains 1,130,241 records pairing email addresses with plaintext passwords and account URLs, with the "EDU" label suggesting the credentials were gathered from education-sector accounts across multiple countries.

Why This Private EDU Combolist Is Dangerous

With over 1.1 million plaintext email and password pairs in one file, attackers can run automated login attempts at massive scale rather than targeting people one at a time. Education-sector accounts frequently connect to financial aid systems, campus payment portals, and personal email, so a working credential here can open far more than just a school login.

What Was Exposed in the EDU Combolist Mix

• Email addresses
• Plaintext passwords
• URLs of the associated accounts

Why a Leak of This Scale Matters

At 1,130,241 records, this is one of the larger combolists HEROIC analysts have tracked recently. Any of those individuals who reused their password on a bank account, personal email, or shopping site is exposed to credential stuffing and account takeover, and because education accounts often hold identity documents and payment details, identity theft and financial fraud are both realistic outcomes for those caught up in this leak.

How Large Mixed Combolists Get Assembled

A "mix" combolist like this one is built by combining credential data harvested from multiple sources, education-sector breaches, malware infections, or older leaks, and merging it into a single file organized by sector and country. Labeling it "private" signals it was intended for limited distribution among buyers before eventually spreading more widely, as tends to happen with large combolists shared on Telegram.

Check If Your Email Is In This Leak

With over a million records in circulation from this file alone, checking your exposure takes seconds and could save you a lot of trouble. HEROIC's free breach scanner searches more than 400 billion leaked records, so you can find out immediately if your email was part of this EDU combolist or any other breach.