135,177 Student Email Logins Found in EDU Combo List Leak

A Combo List Targeting School and University Emails

HEROIC analysts found a file called "EDU COMBO UHQ" circulating on Telegram since June 5, 2026. It contains 135,177 records combining education-domain email addresses with plaintext passwords and the web addresses those logins connect to.

Why This Is Dangerous

School and university email accounts often act as a gateway to far more than the inbox itself. Students and staff use these accounts to access learning portals, financial aid systems, library databases, and sometimes payment information for tuition. With plaintext passwords already attached, an attacker does not need to guess anything, they can simply log in.

What Was Exposed

• Education-domain email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

At a scale of over 135,000 accounts, this list is large enough for automated credential stuffing attacks, where bots try each email and password pair against dozens of other websites in seconds. Because many people reuse passwords between their school account and personal accounts, one leaked combination can lead to account takeover of email, social media, or even banking logins tied to the same password.

How "UHQ" Combo Lists Are Built

"UHQ" stands for ultra high quality, a label sellers use to signal that a combo list has been checked and the logins are confirmed working. These lists are usually assembled from information-stealing malware logs, older breached databases, or both, then filtered and merged by category, in this case by email domain, before being shared or sold in Telegram groups.

Check If You Are Affected

If you or someone in your household uses a school or university email account, it is worth checking whether it appears in this leak. HEROIC's free breach scanner searches more than 400 billion compromised records, including combo lists like this one, so you can find out in seconds and reset any exposed passwords.