Old Bellsouth Email Accounts Surface in a New Telegram Combolist Leak

HEROIC analysts found a combolist titled "bellsouth.et - 805 emails" uploaded to Telegram on June 10, 2026. The file contains 805 records of bellsouth-style email addresses paired with plaintext passwords and associated URLs. Why This Is Dangerous: Bellsouth email addresses are tied to a legacy internet service provider, meaning many of these accounts likely belong to long-time customers who may not actively monitor them anymore. That makes a leak like this easy to overlook, even though all 805 passwords are stored in plaintext and ready for immediate use by anyone who has the file. What Was Exposed: The bellsouth.et file lists three fields per record. - bellsouth-style email addresses - Plaintext passwords - URLs associated with each account Why This Matters: Older, less-monitored email accounts are attractive to attackers precisely because owners are less likely to notice unusual activity. If a password from this leak was reused on a banking or shopping site, or if the account itself is used for password resets elsewhere, this leak can lead directly to credential stuffing, account takeover, or financial fraud. How a Combolist Like This Works: This kind of domain-specific combolist is built by filtering a larger set of leaked credentials down to one provider's addresses, in this case older ISP-based email accounts. These lists are valuable to attackers targeting less-defended, infrequently checked accounts, and they circulate freely on Telegram channels dedicated to trading login credentials. Check If You Are Affected: If you or a family member still uses a Bellsouth email address, it's worth checking now. HEROIC's free breach scanner searches more than 400 billion breached records. If the account is listed, change that password immediately, everywhere it's been reused.