The 3.3K_ProtonMail_CIPHER1987 Leak Just Surfaced on the Dark Web

HEROIC analysts tracked a combolist named "3.3K_ProtonMail_CIPHER1987" that a Telegram user uploaded on August 6, 2026. The file lists 920 records combining email addresses with plaintext passwords and URLs, and its name suggests the credentials were harvested from ProtonMail related logins, primarily tied to United States accounts.

Why the 3.3K_ProtonMail_CIPHER1987 Leak Is Dangerous

Each of the 920 records pairs an email address with its plaintext password and a URL, meaning an attacker does not need to crack or guess anything. They can copy a line from the file and attempt to log straight into the account it names. Because the file's name references ProtonMail, a service many people choose specifically because they think it is more private and secure, anyone whose credentials appear here may not expect that data to be sitting on Telegram at all.

What Was Exposed in This Combolist

• Email addresses
• Plaintext passwords
• URLs linked to each account

Why This Matters If You Are in the CIPHER1987 File

Reusing a password across an email account and other services is common, and it is exactly what makes lists like this dangerous beyond their own numbers. If any of these 920 people used the same password on a bank, social media account, or shopping site, an attacker can try that password there too. That kind of credential stuffing is how a single leaked password turns into a drained account or a stolen identity.

How Combolists Like This Get Made

A combolist is a plain text file that pairs stolen usernames or emails with their matching passwords, often collected from malware infections, phishing pages, or earlier breaches before being repackaged and shared. Telegram channels are a common distribution point because they are free to join and easy to search, letting anyone download a file like this one within seconds.

Check If You Are Affected

If you use ProtonMail or any other email service, it is worth checking whether your address shows up in this leak or any other. HEROIC's free breach scanner searches a database of more than 400 billion breached records so you can see what has been exposed and take action right away.