HEROIC Analysts Trace ‘A Uploaded by a Telegram User’ to 114,060 Leaks

HEROIC analysts identified a large combolist file uploaded to Telegram on 24 May 2026. The file contained 114,060 records pairing email addresses with plaintext passwords, along with associated URLs tied to the accounts. This is a significantly larger dataset than the typical small Telegram dump, meaning well over one hundred thousand working logins are now circulating freely.

Why This Is Dangerous

Because the passwords in this file are stored in plaintext, no cracking or specialized tools are needed to use them. Anyone who downloads the file can immediately try each email and password pair against the site it belongs to, or against other popular services where the same password might be reused. With over 114,000 records, the sheer scale makes this an attractive target for automated attacks.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated account URLs

Why This Matters

Most people reuse passwords across multiple accounts. Attackers load lists like this one into automated tools and test the credentials against banking sites, email providers, and social media platforms, a technique known as credential stuffing. At this scale, even a small success rate means thousands of accounts could be taken over, leading to identity theft and financial fraud for the people affected.

How Combolist Leaks Work

A combolist is a compiled text file of email and password pairs gathered from previous breaches, phishing campaigns, or malware infections, then bundled together and distributed for free or for sale on platforms like Telegram. Building one this large does not require a single major hack. It typically means combining stolen credentials from many smaller sources into one large file, which is why the scale can grow quickly while the original source of any individual record remains unclear.

Check If You Are Affected

With over 114,000 accounts in this dataset, the odds that your information is included are real. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records in seconds, so you can find out immediately and take action if needed.