The 936k France Combo Leak: 836,939 Passwords Hit the Dark Web

HEROIC analysts uncovered a large combolist named "936k France Combo Private," uploaded by a Telegram user on 3 July 2026. Despite the "936k" in its title, the verified file contains 836,939 records pairing email addresses with plaintext passwords and the URLs those credentials unlock.

Why This Is Dangerous

At more than 836,000 records, this is one of the larger combolists HEROIC has tracked recently. That scale matters: it means hundreds of thousands of people have a live email and password pair sitting in a file that anyone on the wrong Telegram channel can download and start testing against real accounts today.

What Was Exposed in the 936k France Combo Leak

• Email addresses
• Plaintext passwords
• URLs showing which sites the credentials belong to

Why This Matters: Scale Turns a Leak Into a Campaign

A list this size is built for automation. Criminals feed hundreds of thousands of email and password combinations into bots that test them against banking, email, and social media logins in bulk, a technique called credential stuffing. Anyone in this file who reused a password elsewhere is at risk of account takeover, identity theft, or direct financial fraud, often without ever knowing their credentials were tested.

How a Combolist of This Size Comes Together

Combolists like this one are usually stitched together from multiple smaller breaches, phishing campaigns, and malware logs, then merged, cleaned of duplicates, and packaged for distribution. A file labeled by scale, such as "936k," is meant to advertise its size to buyers on Telegram and dark web forums. Because the passwords are already in plaintext, no cracking is needed before the credentials can be used against live accounts.

Check If You Are Affected

With more than 836,000 records involved, the odds that your email address appears somewhere in a leak like this are real. HEROIC's free breach scanner checks your information against a database of over 400 billion leaked records, so you can find out immediately and take action to secure your accounts.