The Chollian.net Leak Put 2,043 Korean Email Accounts on the Dark Web

In June 2026, HEROIC analysts found a combolist file targeting chollian.net accounts uploaded to a Telegram channel by an anonymous user. The file contained 2,043 records made up of email addresses, plaintext passwords, and the URLs of the login pages those credentials were captured from.

Why a Webmail Provider Leak Like This Matters

Chollian.net is an email service, and email accounts sit at the center of a person's entire online life. Whoever holds this file has 2,043 working logins to inboxes that likely receive password reset links for banking, shopping, and social media accounts. That makes a leak like this more valuable to an attacker than its size alone might suggest.

What Was Exposed in the Chollian.net Leak

• Email addresses
• Plaintext passwords
• URLs of the login pages those credentials belong to

Why Email Provider Leaks Carry Extra Risk

Because inboxes are used to recover access to other accounts, a compromised email login can quickly become a compromised bank account or social media profile. If any of the 2,043 people in this leak reused their chollian.net password elsewhere, an attacker can use credential stuffing to test that same password across other sites, opening the door to account takeover and identity theft.

How a Provider-Specific Combolist Gets Built

To build a list targeting one email provider, attackers typically pull raw email and password pairs from stealer logs or older breaches, then filter for accounts whose login URL matches that provider. The result is a smaller but more focused file, exactly like the one that surfaced here targeting chollian.net users.

Check If You Are Affected

If you have a chollian.net account or think your email could be part of this leak or any other breach, HEROIC's free breach scanner checks it against a database of more than 400 billion leaked records. Run a scan now and update your password if it turns up.