The citi.com Combolist Contains Exactly 848 Email and Password Pairs

HEROIC analysts identified a targeted combolist called citi.com - 848 emails, uploaded by a Telegram user on 10 June 2026. The citi.com combolist contains exactly 848 email and password pairs, tied to the citi.com domain, alongside the URLs of the login pages each credential belongs to.

Why This Is Dangerous

This is a precise, domain-specific batch rather than a random mixed dump, and that precision makes it more usable. Every one of the 848 records is tied to accounts associated with citi.com, giving whoever holds this list a ready-made target set of email addresses and matching plaintext passwords rather than a haystack of unrelated logins to sort through.

What Was Exposed

• Email addresses tied to the citi.com domain
• Plaintext passwords
• URLs of the login pages tied to each account

Why This Matters

Because the passwords sit in plaintext and are matched to a specific site, an attacker can attempt to log in right away without needing to crack or guess anything. If any of these 848 users reused their password on banking, shopping, or other accounts, the risk extends well past the original citi.com login, opening the door to credential stuffing across unrelated services.

How Combolists Work

A combolist is built by pulling email and password pairs from stealer logs, older breaches, or phishing campaigns, then narrowing the results down to accounts tied to one domain, as with this citi.com-focused batch. Attackers load these domain-specific lists into automated tools that test each pair against the real login page, checking which credentials still work before reselling or reusing the confirmed ones.

Check If You Are Affected

HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including targeted combolists like this one. Run a free search to see if your address is among the 848 exposed.