The ANDORRA CORP-OTHERS-PRO Leak Gives Attackers 1,037 Working Logins

HEROIC analysts found a combolist labeled "ANDORRA CORP-OTHERS-PRO MAILS TEST SAMPLE" uploaded to Telegram in February 2026. The file contains 1,037 records, pairing email addresses with plaintext passwords and the login URLs they belong to.

Why This Is Dangerous

With 1,037 complete email and password pairs sitting in plaintext, an attacker does not need any special skill to cause damage. They can plug this list directly into automated login tools and start testing accounts immediately. Every successful login could hand over access to email, financial accounts, or company systems tied to those addresses.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

Once an attacker has a working email and password pair, the damage rarely stops at one account. They can attempt the same login on banking sites, cloud storage, and social media, hoping the password was reused. From there, a single leaked credential can escalate into identity theft or financial fraud well beyond the original 1,037 accounts in this file.

How Combolists Work

A combolist compiles email and password pairs from various sources, including breaches, phishing pages, and malware-infected devices, into a single file. The label on this one, referencing corporate test email addresses, suggests it was filtered from a larger set before being uploaded, giving whoever finds it a pre-organized list to work through.

Check If You Are Affected

If your organization uses corporate email addresses that could be caught up in a list like this, checking now can prevent a much bigger problem later. HEROIC's free breach scanner searches more than 400 billion leaked records to show you what has surfaced. Run a scan and reset any password that matches.