17,236 Emails and Passwords Leaked in ucl.ac.be Data Breach

HEROIC analysts identified a combolist file uploaded to a Telegram channel in May 2026 containing 17,236 records tied to ucl.ac.be. The file pairs email addresses with plaintext passwords and includes associated URLs, meaning the credentials were captured in a form ready for immediate reuse by anyone who downloads the file.

Why This Is Dangerous

Because the passwords in this dump are stored in plaintext, no cracking or decryption is required. An attacker can open the file and start testing the email and password pairs against other websites within minutes. If any of the 17,236 people in this dataset reused a password across multiple accounts, those other accounts are exposed the moment this file starts circulating.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

Combolists like this one are the raw material for credential stuffing attacks, where automated tools try each email and password pair against banking sites, email providers, and social media platforms. Anyone whose credentials appear here faces a real risk of account takeover, and once one account is compromised, attackers often pivot to identity theft or financial fraud using information found inside it.

How Combolists Work

A combolist is simply a compiled text file of "combo" pairs, usually email plus password, pulled together from older breaches, phishing campaigns, or stealer malware logs and reformatted into one list. Unlike a single-source breach, a combolist can blend credentials from many different origins, which makes it harder for any one company to warn its users because the data was never stolen from them directly. Once posted to a Telegram channel like this one, the file spreads quickly and gets reused by multiple threat actors for months or years afterward.

Check If You Are Affected

The only way to know for certain if your email address was part of this leak is to check it. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including combolists like this one, so you can see in seconds whether your credentials have been exposed and take action before someone else uses them.