9 Records, 3 Data Points: Inside the ‘bugti’ Password Leak

HEROIC analysts identified a small combolist labeled "bugti" uploaded to a Telegram channel on August 20, 2026. The file contains exactly 9 records, and each one includes three specific data points: an email address, a plaintext password, and the URL of the site the credentials belong to.

Why This Is Dangerous

Those three pieces of information, taken together, are all an attacker needs. The URL tells them exactly where to try the login, the email address identifies the account, and the plaintext password means there is nothing to crack or guess. For each of these 9 records, the path from leaked file to compromised account is immediate.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

Even a file with only 9 entries feeds the same machinery as a massive breach. Automated tools take each email, password, and URL combination and attempt to log in, and if any of these 9 people reused their password on another account, the attacker can pivot from one exposed login into several. That is how a handful of records turns into credential stuffing, account takeover, and eventually identity theft or financial fraud.

How Combolists Work

A combolist is a plain text file pairing usernames or email addresses with passwords, usually gathered from phishing pages, malware infections, or earlier breaches and shared on Telegram channels. Short file names like "bugti" are common among uploaders who release many small batches, but the three data points inside, email, password, and URL, are exactly the ingredients needed for an automated login attempt.

Check If You Are Affected

Even a leak this small is worth checking. HEROIC's free breach scanner searches more than 400 billion leaked records, so you can quickly find out whether your email and password appear in this dataset or any other, and change your credentials before someone else uses them.