Clienteselcorteingles.es Leak Targets El Corte Ingles Shoppers

HEROIC analysts found a small combolist tied to clienteselcorteingles.es, the customer portal for Spanish retailer El Corte Ingles, shared by a Telegram user in late July 2026. The file contained 6 records pairing email addresses with plaintext passwords and the URLs each login was used on. Why this is dangerous: with only 6 accounts involved, this is a small leak, but the passwords were stored in plaintext, meaning anyone who has the file can log in to these accounts immediately without any additional effort. For the individuals affected, the risk is just as real as it would be in a larger breach. What was exposed: email addresses, plaintext passwords, and associated URLs showing where each credential was used, in this case tied to El Corte Ingles' customer portal. Why this matters: shopping accounts like this one often store saved payment methods, order history, and personal details. If any of these 6 people reused their password elsewhere, attackers could use the same login to access email, banking, or other retail accounts through credential stuffing, which can lead to financial fraud or identity theft. How combolists like this one work: a combolist pairs usernames or emails with passwords, usually gathered from previous breaches, malware infections, or manual scraping of specific sites, then labeled by source and shared or sold on Telegram channels and dark web forums. Attackers often target retail customer portals specifically because they can contain payment and shipping information alongside login credentials. Check if you are affected: if you shop at El Corte Ingles or reuse passwords across retail sites, it is worth checking whether your information appears in this leak. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records so you can quickly find out and take action if needed.